9.8
CRITICAL CVSS 3.1
CVE-2025-26198
CloudClassroom-PHP-Project SQL Injection
Description

CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.

INFO

Published Date :

June 18, 2025, 6:15 p.m.

Last Modified :

July 9, 2025, 6:31 p.m.

Remotely Exploit :

Yes !
Affected Products

The following products are affected by CVE-2025-26198 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Vishalmathur cloudclassroom-php_project
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL 134c704f-9b21-4f2e-91b3-4a467353bcc0
Solution
Sanitize all SQL query inputs and use parameterized queries.
  • Sanitize user input before SQL queries.
  • Use parameterized queries or prepared statements.
  • Validate and sanitize all data inputs.
  • Review database access controls.
Public PoC/Exploit Available at Github

CVE-2025-26198 has a 2 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-26198.

URL Resource
https://gist.github.com/tansique-17/0776791b8edd4931216be452a6971f5e Exploit Third Party Advisory
https://github.com/tansique-17/CVE-2025-26198/ Exploit Third Party Advisory
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-26198 is associated with the following CWEs:

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Public Disclosure

Updated: 1 month, 1 week ago
0 stars 0 fork 0 watcher
Born at : June 18, 2025, 6:19 p.m. This repo has been linked 1 different CVEs too.

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 13 hours, 23 minutes ago
7229 stars 1202 fork 1202 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 802 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-26198 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2025-26198 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Jul. 09, 2025

    Action Type Old Value New Value
    Added CPE Configuration OR *cpe:2.3:a:vishalmathur:cloudclassroom-php_project:1.0:*:*:*:*:*:*:*
    Added Reference Type MITRE: https://gist.github.com/tansique-17/0776791b8edd4931216be452a6971f5e Types: Exploit, Third Party Advisory
    Added Reference Type MITRE: https://github.com/tansique-17/CVE-2025-26198/ Types: Exploit, Third Party Advisory
  • CVE Modified by [email protected]

    Jun. 20, 2025

    Action Type Old Value New Value
    Changed Description CloudClassroom-PHP-Project v.1.0 is vulnerable to SQL Injection in loginlinkadmin.php, allowing unauthenticated attackers to bypass authentication and gain administrative access. The application fails to properly sanitize user inputs before constructing SQL queries, enabling an attacker to manipulate database queries via specially crafted payloads CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.
    Added Reference https://github.com/tansique-17/CVE-2025-26198/
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Jun. 18, 2025

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added CWE CWE-89
  • New CVE Received by [email protected]

    Jun. 18, 2025

    Action Type Old Value New Value
    Added Description CloudClassroom-PHP-Project v.1.0 is vulnerable to SQL Injection in loginlinkadmin.php, allowing unauthenticated attackers to bypass authentication and gain administrative access. The application fails to properly sanitize user inputs before constructing SQL queries, enabling an attacker to manipulate database queries via specially crafted payloads
    Added Reference https://gist.github.com/tansique-17/0776791b8edd4931216be452a6971f5e
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 9.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact