CVE-2026-97885 is a SQL injection in CloudClassroom-PHP-Project, in updatefaculty.php through the fid parameter. The record rates it high (CVSS 7.3) while the researcher advisory rates it critical (9.1). No fixed release exists and the vendor did not respond, so limit exposure and patch your own copy.
What's affected
The record covers mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected file is updatefaculty.php and the manipulated argument is fid. The project uses a rolling release model, so no affected or fixed version numbers exist in the record. The vendor did not respond to early contact, and the record says the exploit is published.
Where the sources differ: the NVD record scores this at 7.3, high, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The researcher advisory we read, which carries an internal identifier and says a CVE was pending at the time, rates it critical at 9.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. It also names version 1.0 and prior as affected and lists no fix. We use the record's 7.3 as the headline score and flag the other, so decide for yourself how to rate it in your environment.
The advisory also says the original design needs an admin session and that a separate broken access control issue lowers that barrier. That is the researcher's claim and not part of the record. KEV is false.
How to check if you're exposed
Find any deployments of CloudClassroom-PHP-Project and look for updatefaculty.php. If you deployed from the repository, compare your commit against 5dadec098bfbbf3300d60c3494db3fb95b66e7be with git log.
Review web server logs for requests to updatefaculty.php. Look at the fid values: it is meant to hold a number, so anything else is suspicious. Database error messages in application logs are another sign of probing.
Check whether the page can be reached without logging in. The advisory says access control around it is weak, so test that yourself in a safe, authorised way and do not rely on the page being hidden.
What to do now
- Remove public access to the application until it is fixed, or place it behind a VPN or single sign on.
- Back up the database and rotate any credentials it holds, especially administrator passwords, which the advisory says are stored in a readable form.
- In your copy of updatefaculty.php, replace the string built query with a prepared statement and cast fid to an integer.
- Add an authorisation check so only administrators can reach the page.
- Retire the project if it is only a demo or class exercise.
Why it matters
The weakness types are CWE-74, CWE-89. A request value is concatenated into a query without quoting or binding. The advisory describes the parameter as numeric and unquoted, which is a common way these bugs appear. Prepared statements remove the problem at its root.
Differing scores like 7.3 and 9.1 are normal when a researcher reasons about a whole chain and a CVE record scores a single weakness. For triage, the useful question is what an attacker could read or change in your database, and who can reach the page. This sample app stores credentials, so the answer in practice may be severe.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It covers packages and libraries your projects pull in, so it will not see a standalone application or a kernel, but it is a quick way to find out which third party components you are carrying at all. Reachability analysis then helps you separate vulnerable code that your application actually calls from code that only sits in a dependency tree.
Quick check
Why are there two different scores?
The NVD record says 7.3 high. The researcher advisory says 9.1 critical, with higher confidentiality and integrity impact. Both are shown above, and your own context should decide how urgent it is.
Is there a fixed version?
No. The record cites rolling releases and no fix, and the advisory lists none. Patch your own copy or take it out of service.
Sources
Gold entry for CVE-2026-97885 Researcher advisory VulDB entry
Last reviewed: 18 October 2026.
