Executive brief
A security vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the modification of records. This issue can be exploited remotely without requiring any user login or special permissions.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/edit_course.php' file. The root cause is the failure to properly sanitize or validate the 'id' parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending a specially crafted GET request containing SQL commands. Successful exploitation allows for boolean-based blind, error-based, time-based blind, and UNION-based SQL injection, enabling full database access, data exfiltration, or tampering. No official patch is currently available; users are advised to implement prepared statements and parameter binding.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-02: disclosed: Vulnerability details and PoC published on GitHub
- 2026-07-04: advisory: NVD publication date