CVE-2025-26198
Last modified
CVE-2025-26198 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. EPSS estimates a 0.57% chance of exploitation in the next 30 days.
Description
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vishalmathur | Cloudclassroom-Php Project | 1.0 |
References
- https://gist.github.com/tansique-17/0776791b8edd4931216be452a6971f5eExploit, Third Party Advisory
- https://github.com/tansique-17/CVE-2025-26198/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-26198?
How severe is CVE-2025-26198?
How do I fix CVE-2025-26198?
Are you affected by CVE-2025-26198?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST