Executive brief
SourceCodester Class and Exam Timetabling System, a web application for managing academic schedules, contains a security flaw that allows attackers to interfere with its database. By sending specially crafted requests to the system's product editing page, an unauthorized user can view, modify, or delete sensitive information. This could lead to a complete loss of data integrity or the exposure of private records without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/edit_product.php' file. The root cause is the failure to sanitize or validate the 'id' GET parameter before using it in a database query. An unauthenticated remote attacker can exploit this by submitting malicious SQL payloads, including boolean-based blind, error-based, time-based blind, and UNION-based queries. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. A public proof-of-concept (PoC) using sqlmap has been disclosed.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-04: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-07-05: advisory: NVD/VulDB advisory published