Executive brief
A security vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could result in the theft of sensitive school data, modification of exam schedules, or complete loss of database integrity.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the /edit_class1.php file. The root cause is the improper neutralization of the 'id' GET parameter before it is used in a SQL query. A remote, unauthenticated attacker can manipulate this parameter to execute arbitrary SQL commands. Testing has confirmed that the application is susceptible to boolean-based blind, error-based, time-based blind, and UNION-based SQL injection techniques. Successful exploitation allows for full database extraction, data tampering, or unauthorized administrative access. No patch is currently documented; developers are advised to implement prepared statements with parameterized queries.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-31: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-29: advisory: NVD/VulDB advisory published