CVE-2025-26199

The application does not use TLS/HTTPS encryption when transmitting the login form, which means that passwords are sent as plain text over the network. An attacker present on the same network (e.g., public Wi-Fi or compromised router) can perform a Man-in-the-Middle (MitM) attack and intercept transmitted authentication data. After obtaining login credentials, the attacker can log into the application and exploit available administrative functions — in particular the file upload function — which depending on the environment configuration may lead to remote code execution (RCE).

An attacker can intercept user login credentials, take over their accounts, and in case of obtaining administrative access — lead to remote code execution on the server, resulting in complete breach of system confidentiality, integrity, and availability.

The application should be configured to handle only HTTPS connections with a valid TLS certificate and disable access through unencrypted HTTP. Patches available from the vendor should be applied according to references. As an interim remedial measure, it is recommended to place the application behind a reverse proxy enforcing HTTPS (e.g., nginx, Apache) and consider implementing HTTP Strict Transport Security (HSTS).

CloudClassroom-PHP-Project v1.0 (project by Vishalmathur)