Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

CloudClassroom-PHP-Project login form vulnerable to unauthorized access

CVE-2025-26198 · published 1 year ago
Summary

The CloudClassroom-PHP-Project's admin login form doesn't properly check user input, making it possible for attackers to gain access to the system without a password. This could allow unauthorized people to see sensitive information or make changes to the system. To fix this, update the login form to properly check and sanitize user input.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
vishalmathur cloudclassroom-php_project 1.0
cpe:2.3:a:vishalmathur:cloudclassroom-php_project:1.0:*:*:*:*:*:*:*
Original advisory text
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form be...
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published18 Jun 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-26198 · NVD
Track software like this
Free during beta