A critical SQL injection vulnerability in the CloudClassroom-PHP-Project allows unauthenticated attackers to compromise sensitive database information and potentially gain full application control.

This vulnerability is a SQL injection (CWE-89) located in the postquerypublic.php file. An unauthenticated attacker can supply a malicious payload to the gnamex POST parameter, which is then concatenated directly into a database query without sanitization.

Successful exploitation permits an attacker to perform unauthorized database operations, including the extraction of sensitive credentials, exam data, and administrative information. Given the CVSS score of 7.3 and the ability for remote, unauthenticated access, this flaw poses a significant risk to data confidentiality and integrity. The project is confirmed to be discontinued, which elevates the risk of permanent exposure.

Immediate Action: As the project is discontinued and no official patch is available, organizations should immediately migrate to a supported e-learning platform. If immediate migration is impossible, remove the vulnerable postquerypublic.php functionality entirely.

Proactive Monitoring: Monitor web server logs for suspicious POST requests to /postquerypublic containing SQL syntax characters such as single quotes, double dashes, or common injection functions like updatexml.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious payloads targeting the gnamex parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's technical write-up provided in the references.

The severity of this SQL injection, combined with the fact that the software is discontinued and lacks a vendor patch, necessitates urgent action. Organizations currently utilizing this project are strongly advised to transition to a modern, actively maintained alternative to prevent potential data breaches. If the application must remain online, implement strict network-level access controls and WAF protections as a temporary measure while planning for decommissioning.