Executive brief
A vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive school records or the disruption of scheduling operations. This attack can be performed remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/preview4.php' component. The root cause is the improper neutralization of the 'course_year_section' POST parameter before it is used in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads, including boolean-based blind, error-based, and UNION-based techniques. Successful exploitation allows for unauthorized database access, data exfiltration, and potential modification of system records. No official patch is currently documented, but remediation should involve implementing prepared statements and input validation.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-28: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-29: advisory: NVD/VulDB advisory published