This vulnerability in mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be involves SQL injection via the 'gname' parameter in updateguest.php. An attacker can remotely manipulate this parameter to execute arbitrary SQL commands. The product's rolling release model prevents precise version identification of affected releases. The vendor was contacted but did not provide any response or patch information. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification. The CVSS 4.0 score of 5.3 indicates a medium impact with network attack vector, low complexity, and no user interaction required. However, the lack of vendor response and patch increases the risk for users of this software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying manual code review and input validation on the 'gname' parameter to mitigate SQL injection risks. Monitoring for updates from the vendor is recommended.