SQL Injection in CloudClassroom-PHP-Project Faculty Authentication

A SQL injection vulnerability has been identified in the Faculty Authentication component of the mathurvishal CloudClassroom-PHP-Project, affecting all versions up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The vulnerability is located within the loginlinkfaculty.php file and is triggered via manipulation of the 'fid' (faculty ID) or 'pass' (password) arguments. This flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data access, authentication bypass, or complete database compromise. As the project utilizes a rolling release model without discrete versioning, users are advised to review the source repository for recent patches. The vulnerability has been publicly disclosed with functional exploit code available, increasing the likelihood of opportunistic targeting.

Impact

Successful exploitation of CVE-2026-97882 results in unauthorized SQL query execution. This allows attackers to extract sensitive faculty or student information, bypass authentication mechanisms, or modify application data. Given the public availability of exploit code, organizations deploying this project are at high risk of automated exploitation attempts.

Recommendation

1. Implement strict input validation and parameterized queries for all database interactions within loginlinkfaculty.php.
2. Monitor web server logs for suspicious requests to loginlinkfaculty.php that contain SQL keywords or syntax characters (e.g., UNION, SELECT, OR 1=1) within the 'fid' or 'pass' parameters.
3. Deploy a Web Application Firewall (WAF) rule to block incoming POST/GET requests targeting loginlinkfaculty.php that exhibit signs of SQL injection, specifically looking for anomalous input in the 'fid' and 'pass' fields.
4. Perform a code audit of the Faculty Authentication module to ensure all user-supplied inputs are sanitized before being passed to database functions.