Executive brief
A security vulnerability has been identified in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could result in the theft of sensitive student or exam data, unauthorized modification of schedules, or a complete shutdown of the system.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/edit_exam1.php' component. The root cause is the improper neutralization of the 'id' GET parameter before it is used in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL queries to the server. Successful exploitation allows for unauthorized database access, including data exfiltration (via UNION-based or error-based techniques) and potential data tampering. A public exploit (PoC) has been released, but no official patch is currently available; users are advised to implement prepared statements and input validation manually.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-05: disclosed: Vulnerability reported on GitHub by zzb1388
- 2026-07-05: advisory: NVD and VulDB published the advisory