Executive brief
A security vulnerability has been identified in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could result in the theft of sensitive school data, unauthorized modification of schedules, or disruption of system operations.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/preview5.php' component. The root cause is the improper neutralization of the 'course_year_section' POST parameter before it is used in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads (including boolean-based blind, error-based, and UNION-based techniques) to manipulate database queries. Successful exploitation allows for unauthorized data retrieval, modification, or full database compromise. A public exploit (PoC) is available.
Affected products
- SourceCodester Class and Exam Timetabling System Project 1.0
Timeline
- 2026-05-27: disclosed: Initial discovery and report on GitHub
- 2026-06-29: advisory: NVD publication date