Executive brief
SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules, contains a security vulnerability that allows unauthorized access to its database. By sending a specially crafted request to the system's preview page, an attacker can bypass security controls to view, modify, or delete sensitive information. This could lead to a complete compromise of the scheduling data and potential disruption of school operations.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/preview.php' component. The root cause is the improper neutralization of special elements in the 'course_year_section' POST parameter, which is used directly in SQL queries without adequate validation or prepared statements. A remote, unauthenticated attacker can exploit this by submitting malicious SQL payloads (including boolean-based blind, error-based, and UNION-based techniques) to gain unauthorized access to the underlying database. This can result in sensitive data leakage, data tampering, or full system compromise. No fix is currently documented in the advisory, though the use of prepared statements is recommended.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-27: disclosed: Vulnerability reported on GitHub by lffaker
- 2026-06-28: advisory: NVD/VulDB advisory published