Executive brief
A vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the modification of system records. This could result in significant data exposure and disruption of academic operations.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/edit_course1.php' component. The root cause is the failure to properly sanitize or validate the 'id' GET parameter before using it in a SQL query. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests containing malicious SQL payloads (including boolean-based blind, error-based, and UNION-based techniques). Successful exploitation allows for unauthorized database access, sensitive data exfiltration, and potential data tampering. No patches are currently known to be available; developers are advised to implement prepared statements and parameter binding.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-05: disclosed: Vulnerability details and PoC published on GitHub.
- 2026-07-05: advisory: CVE published and NVD record created.