CVE-2025-26198

CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/tansique-17/0776791b8edd4931216be452a6971f5e	Exploit Third Party Advisory
https://github.com/tansique-17/CVE-2025-26198/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vishalmathur:cloudclassroom-php_project:1.0:*:*:*:*:*:*:*

History

09 Jul 2025, 18:31

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-18 18:15

Updated : 2025-07-09 18:31

NVD link : CVE-2025-26198

Mitre link : CVE-2025-26198

CVE.ORG link : CVE-2025-26198

JSON object : View

Products Affected

vishalmathur

cloudclassroom-php_project

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-26198", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-06-18T18:15:24.097", "references": [{"url": "https://gist.github.com/tansique-17/0776791b8edd4931216be452a6971f5e", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/tansique-17/CVE-2025-26198/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data."}, {"lang": "es", "value": "CloudClassroom-PHP-Project v.1.0 es vulnerable a la inyecci\u00f3n SQL en loginlinkadmin.php, lo que permite a atacantes no autenticados eludir la autenticaci\u00f3n y obtener acceso administrativo. La aplicaci\u00f3n no depura correctamente las entradas del usuario antes de construir consultas SQL, lo que permite a un atacante manipular las consultas de la base de datos mediante payloads especialmente manipulados."}], "lastModified": "2025-07-09T18:31:21.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vishalmathur:cloudclassroom-php_project:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C9EE693-395C-473A-95BD-57C656C61AB3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}