Executive brief
A security vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing school schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive school data, modification of exam records, or disruption of the scheduling system's operations.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/preview7.php' file. The root cause is the improper neutralization of the 'course_year_section' POST parameter, which is used directly in SQL queries without sufficient validation or prepared statements. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads (including boolean-based blind, error-based, and UNION-based techniques). Successful exploitation allows for unauthorized database access, data exfiltration, and potential modification of database records. Public exploit code (PoC) has been released.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-27: disclosed: Initial disclosure on GitHub by user zzb1388
- 2026-06-28: advisory: NVD/VulDB advisory published