Executive brief
A security vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the modification of exam records. This issue can be exploited remotely without requiring any user login or special permissions.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/edit_exam.php' component. The root cause is the failure to properly sanitize or validate the 'id' GET parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads (including boolean-based blind, error-based, time-based blind, and UNION-based techniques) to manipulate queries. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. As of the advisory date, no official patch is mentioned, but remediation involves using prepared statements with parameter binding.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-04: disclosed: Vulnerability details and PoC shared on GitHub by zzb1388
- 2026-07-05: advisory: NVD/VulDB publication date