Executive brief
A security vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the disruption of scheduling operations. This attack can be carried out remotely without requiring any user login or special permissions.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/archive2.php' file. The root cause is the improper neutralization of the 'sy' POST parameter before it is used in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads (including boolean-based blind and error-based techniques) to manipulate database queries. Successful exploitation allows for unauthorized data retrieval, modification, or deletion. The exploit has been publicly disclosed via GitHub issues, and remediation involves implementing prepared statements with parameter binding.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-20: disclosed: Vulnerability details and PoC published on GitHub
- 2026-06-08: advisory: NVD/VulDB advisory published