This vulnerability involves SQL injection in the CloudClassroom-PHP-Project by mathurvishal, specifically in the updatedetailsfromstudent.php file where the eno argument is improperly sanitized. This allows remote attackers to inject SQL commands. The product uses continuous delivery with rolling releases, so no exact affected or patched versions are identified. The vendor was contacted but did not respond. The CVSS 4.0 score is 6.9 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and partial impact on confidentiality, integrity, and availability.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No confirmed exploits in the wild are reported.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Since the vendor has not responded and no fixed versions are available, users should monitor for official updates or consider code review and manual mitigation of the eno parameter in updatedetailsfromstudent.php to prevent SQL injection.