Executive brief
SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules, contains a security flaw that allows unauthorized access to its database. By sending a specially crafted web request, an attacker can bypass security controls to view, modify, or delete sensitive information stored in the system. This could lead to the exposure of student or exam data and disrupt school operations.
Technical details
A SQL injection vulnerability was identified in the '/edit_class2.php' component of SourceCodester Class and Exam Timetabling System 1.0. The issue arises from the lack of proper sanitization or validation of the 'id' GET parameter before it is used in a SQL query. An unauthenticated remote attacker can exploit this by providing malicious SQL commands, enabling boolean-based blind, error-based, time-based blind, and UNION-based attacks. Successful exploitation allows for full database enumeration, data exfiltration, and unauthorized modification of records. No patch is currently documented, but remediation should involve implementing prepared statements with parameterized queries.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-02: disclosed: Vulnerability reported on GitHub by zzb1388
- 2026-07-04: advisory: NVD/VulDB advisory published