Executive brief
A security vulnerability exists in the SourceCodester Class and Exam Timetabling System, a software tool used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive school records, unauthorized modification of exam schedules, or complete disruption of the system's operations.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 due to improper neutralization of special elements in the 'id' parameter of the '/edit_coursea.php' script. The application fails to validate or sanitize user input before using it in a database query, allowing for boolean-based blind, error-based, time-based blind, and UNION-based SQL injection attacks. A remote, unauthenticated attacker can exploit this to execute arbitrary SQL commands, potentially leading to full database compromise and sensitive data exfiltration. A public exploit (PoC) using sqlmap has been disclosed. No official patch is currently documented, but developers are advised to use prepared statements and parameter binding.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-04: disclosed: Vulnerability details and PoC shared on GitHub by zzb1388
- 2026-07-05: advisory: NVD/VulDB advisory published