This vulnerability in mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be allows remote attackers to perform SQL injection by manipulating the gname/editassid argument in the /updateguest.php file. The exact function affected is unknown. The product uses a rolling release model, so no specific affected or fixed versions are provided. The vendor was contacted but did not respond. Public exploit code is available.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database with low privileges, potentially leading to data leakage or modification. The CVSS score of 5.3 indicates a medium impact with network attack vector, low complexity, and no user interaction required. However, the exact impact depends on the database and application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch information is available, users should consider applying manual mitigations such as input validation and parameterized queries for the affected parameters. Monitor official channels for updates from the vendor.