Executive brief
The SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules, contains a security flaw that allows unauthorized individuals to access its database. By sending a specially crafted web request, an attacker can view, modify, or delete sensitive information without needing a username or password. This could lead to the exposure of student or faculty data and disruption of school operations.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/edit_room.php' component. The application fails to properly sanitize or validate the 'id' GET parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by submitting malicious SQL payloads (including boolean-based blind, error-based, time-based blind, and UNION-based techniques) to achieve unauthorized database access. This can result in full data exfiltration or manipulation. No official patch is currently documented, but remediation should involve implementing prepared statements with parameterized queries.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-05: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-07-05: advisory: CVE published and indexed by NVD/VulDB