Executive brief
A security vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive school records, tampering with exam schedules, or a complete shutdown of the scheduling service.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/preview3.php' file. The root cause is the failure to sanitize or validate the 'course_year_section' POST parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads (including boolean-based blind, error-based, time-based blind, and UNION-based techniques). Successful exploitation allows for unauthorized database access, data exfiltration, and potential modification of records. As of the advisory date, no official patch has been released; users are advised to implement prepared statements and parameter binding manually.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-31: disclosed: Initial discovery and PoC shared on GitHub by zzb1388/Tomato0o.
- 2026-06-29: advisory: NVD and VulDB published the vulnerability details.