Executive brief
SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules, contains a security vulnerability that allows attackers to interfere with its database. By sending specially crafted web requests, an unauthorized person can view sensitive information, modify records, or potentially disrupt the system's availability. This could lead to unauthorized access to student or faculty data and the corruption of institutional scheduling records.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/archive1.php' file. The root cause is the improper neutralization of special elements in the 'sy' POST parameter, which is used directly in SQL queries without adequate validation or sanitization. A remote, unauthenticated attacker can exploit this by submitting malicious SQL payloads (including boolean-based blind and error-based techniques) to perform unauthorized database operations. This can result in the leakage of sensitive data, modification of database contents, or full system compromise. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-20: disclosed: Vulnerability details and PoC shared on GitHub issue
- 2026-06-08: advisory: NVD/VulDB advisory published