Executive brief
A security vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive school records, modification of exam schedules, or disruption of the system's availability.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/archive4.php' component. The root cause is the improper neutralization of special elements in the 'sy' POST parameter, which is used directly in SQL queries without adequate validation or filtering. A remote, unauthenticated attacker can exploit this by sending crafted HTTP POST requests to manipulate database queries. Successful exploitation allows for unauthorized data retrieval, modification, or deletion via boolean-based blind or error-based SQL injection techniques. Public exploit code (PoC) has been released.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-20: disclosed: Initial disclosure on GitHub by researcher zzb1388
- 2026-06-08: advisory: NVD/VulDB publication date