Executive brief
A security vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could result in the theft of sensitive school data, unauthorized modification of schedules, or disruption of the system's availability.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/preview6.php' component. The root cause is the improper neutralization of the 'course_year_section' POST parameter, which is used directly in SQL queries without sufficient validation or prepared statements. A remote, unauthenticated attacker can exploit this by sending crafted SQL payloads (including boolean-based blind, error-based, and UNION-based techniques) to manipulate database queries. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. A public exploit (PoC) has been disclosed.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-27: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-28: advisory: CVE published and listed on NVD/VulDB