Executive brief
SourceCodester Class and Exam Timetabling System is a web application used to manage academic schedules. A security flaw in the class editing component allows remote attackers to interfere with the underlying database without needing a username or password. This could lead to the theft of sensitive school data, unauthorized changes to schedules, or a complete loss of access to the system.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/edit_class.php' file. The root cause is the improper neutralization of the 'id' GET parameter before its use in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests to perform boolean-based blind, error-based, time-based blind, or UNION-based SQL injection attacks. Successful exploitation allows for unauthorized database access, data exfiltration, and potential administrative bypass. A public exploit (PoC) has been released.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-28: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-29: advisory: NVD publication date