Executive brief
A vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive school records, unauthorized modification of exam schedules, or a complete shutdown of the scheduling service.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/archive.php' component. The root cause is the improper neutralization of the 'sy' POST parameter before it is used in a SQL query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads to perform boolean-based blind or error-based injection. Successful exploitation allows for unauthorized database access, data exfiltration, and potential administrative bypass. A public exploit (PoC) is available, and remediation involves implementing prepared statements with parameterized queries.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-27: disclosed: Initial discovery and PoC shared on GitHub
- 2026-06-28: advisory: NVD publication date