CVE-2026-2058: mathurvishal CloudClassroom-PHP-Project SQL Injection in postquerypublic.php

Overview

A SQL injection flaw (CWE-89) has been reported in mathurvishal CloudClassroom-PHP-Project. The issue affects an unspecified function in /postquerypublic.php, part of the Post Query Details Page component, and the record states it can be reached remotely. The recorded affected version is version 1.0. The record also says the vendor did not respond to early disclosure contact. See the NVD entry and the VulDB entry.

Impact

• A successful SQL injection may allow an attacker to read or modify data in the back-end database. This is a general characteristic of CWE-89 and is an inference, not a confirmed outcome in this record.
• NVD assigns CVSS 3.1 base score 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates high impact on confidentiality, integrity and availability.
• The CNA (VulDB) lists a lower CVSS 3.1 score of 7.3 for the same issue.

Affected products and versions

• Product: mathurvishal CloudClassroom-PHP-Project (listed in the record as Vishalmathur Cloudclassroom-php-project).
• Version recorded: version 1.0.
• The description refers to the product up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be.
• The project uses a rolling release model, so the sources cannot specify exact affected or updated releases.

Exploitation status

• The CISA KEV data in the record shows this CVE is not listed. No confirmed active exploitation is stated in the sources consulted.
• The record states that an exploit has been published and may be used, and it references exploit-tagged third-party material. Public exploit availability makes prompt defensive action more important.

Remediation and mitigation

• No fixed version is listed in the record. This is unknown, not evidence that no fix exists.
• Restrict access to the affected application, especially public query pages, until the code has been reviewed.
• Review how the gnamex input is handled and move database queries to parameterized statements or prepared statements.
• If the project is deployed, consider replacing it with a maintained alternative or removing it from internet exposure.

Detection guidance

• Review web server and application logs for unusual requests to /postquerypublic.php, especially requests with abnormal values in the gnamex parameter.
• Monitor application database errors and unexpected query behavior originating from the web application.
• Consider web application firewall rules as a temporary compensating control, tested for false positives.

Limitations of the available information

• The record does not confirm the full affected version range, a fixed version, or a vendor patch.
• No official vendor advisory is cited in the record, and the vendor did not respond to disclosure.
• NVD and CNA CVSS scores differ; the record does not determine which better reflects a specific deployment.
• The KEV data does not confirm exploitation in the wild.

Frequently asked questions

Is CVE-2026-2058 known to be actively exploited?

The CISA KEV data in the record does not list this CVE, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been published, so the risk of exploitation should be treated seriously.

Is there a patch for this vulnerability?

The record does not list any fixed version or vendor patch. Because the project uses a rolling release model and the vendor did not respond, the availability of a fix is unknown. Restricting access and reviewing query handling are the main defensive steps available from the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.