CVE-2025-46179

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-46179
A SQL Injection vulnerability was discovered in the askquery.php file of CloudClassroom-PHP Project v1.0. The squeryx parameter accepts unsanitized input, which is passed directly into backend SQL queries.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://pastebin.com/DGraeWm8 Exploit Third Party Advisory
https://portswigger.net/web-security/sql-injection Not Applicable
https://pastebin.com/DGraeWm8 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vishalmathur:cloudclassroom-php_project:1.0:*:*:*:*:*:*:*
History

26 Jun 2025, 14:48

Type Values Removed Values Added
First Time Vishalmathur cloudclassroom-php Project
Vishalmathur
CPE cpe:2.3:a:vishalmathur:cloudclassroom-php_project:1.0:*:*:*:*:*:*:*
References () https://pastebin.com/DGraeWm8 - () https://pastebin.com/DGraeWm8 - Exploit, Third Party Advisory
References () https://portswigger.net/web-security/sql-injection - () https://portswigger.net/web-security/sql-injection - Not Applicable

24 Jun 2025, 16:15

Type Values Removed Values Added
References () https://pastebin.com/DGraeWm8 - () https://pastebin.com/DGraeWm8 -
Summary
  • (es) Se descubrió una vulnerabilidad de inyección SQL en el archivo askquery.php de CloudClassroom-PHP Project v1.0. El parámetro squeryx acepta entradas no depuradas, que se pasan directamente a las consultas SQL del backend.
CWE CWE-89
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

23 Jun 2025, 20:16

Type Values Removed Values Added
Summary
  • (es) Se descubrió una vulnerabilidad de inyección SQL en el archivo askquery.php de CloudClassroom-PHP Project v1.0. El parámetro squeryx acepta entradas no depuradas, que se pasan directamente a las consultas SQL del backend.

20 Jun 2025, 15:15

Type Values Removed Values Added
New CVE
Summary
  • (es) Se descubrió una vulnerabilidad de inyección SQL en el archivo askquery.php de CloudClassroom-PHP Project v1.0. El parámetro squeryx acepta entradas no depuradas, que se pasan directamente a las consultas SQL del backend.
Information

Published : 2025-06-20 15:15

Updated : 2025-06-26 14:48

NVD link : CVE-2025-46179

Mitre link : CVE-2025-46179

CVE.ORG link : CVE-2025-46179

JSON object : View

Products Affected

vishalmathur

  • cloudclassroom-php_project
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')