CloudClassroom-PHP-Project v1.0 is vulnerable to insecure transmission of user credentials. During the authentication process, passwords are submitted over unencrypted HTTP rather than HTTPS. This exposes sensitive information (i.e., usernames and passwords) to interception by network-based attackers using packet sniffing or Man-in-the-Middle (MitM) attacks.
If an attacker captures valid admin credentials, they may log in and potentially exploit additional application functionality (e.g., file upload or remote shell injection) to achieve remote code execution, depending on the deployment context and system configuration.
- Name: CloudClassroom-PHP-Project
- Version: 1.0
- Repository: https://github.com/mathurvishal/CloudClassroom-PHP-Project
- Credential Interception: Passwords transmitted in cleartext can be stolen by attackers on the same network.
- Account Takeover: Captured credentials can be reused to gain admin access.
- Remote Code Execution (in chained scenarios): If the admin panel includes file uploads or other critical operations, attackers can achieve code execution.
POST http://localhost/CloudClassroom-PHP-Project-master/loginlinkadmin.php-
Clone the Repository
git clone https://github.com/mathurvishal/CloudClassroom-PHP-Project.git
-
Host the Application
- Use XAMPP, LAMP, or any local server stack.
- Access via:
http://localhost/CloudClassroom-PHP-Project-master/loginlinkadmin.php
-
Perform Login over HTTP
- Intercept the request using a proxy tool (e.g., Burp Suite or Wireshark).
- Observe the password sent in plaintext over an unencrypted channel.
-
Attack Vector
- An attacker in a shared network environment captures the HTTP request and retrieves credentials from the payload.
- Enforce HTTPS for all authentication and sensitive endpoints.
- Configure web server to redirect all HTTP traffic to HTTPS.
- Educate users to never enter credentials on HTTP pages.
- Use HSTS (HTTP Strict Transport Security) to prevent protocol downgrades.
-
CWE-319: Cleartext Transmission of Sensitive Information
https://cwe.mitre.org/data/definitions/319.html -
(Optional if RCE is possible)
CWE-306: Missing Authentication for Critical Function
https://cwe.mitre.org/data/definitions/306.html
- Score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
| Event | Date |
|---|---|
| Vulnerability Discovered | 15 April 2025 |
| Public Disclosure | 18 June 2025 |
| Patch Available | No |
This vulnerability was discovered and responsibly disclosed by:
Tansique Dasari
📧 tansique.d@gmail.com
🔗 https://github.com/tansique-17