Executive brief
A security vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the modification of records. This attack can be carried out remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/edit_exam2.php' file. The root cause is the improper neutralization of the 'id' GET parameter before it is used in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads (including boolean-based blind, error-based, time-based blind, and UNION-based techniques) to manipulate database queries. Successful exploitation allows for unauthorized data retrieval, modification, or deletion. Public exploit code (PoC) has been released.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-10: disclosed: Vulnerability reported on GitHub by zzb1388
- 2026-07-13: advisory: CVE published and listed on NVD/VulDB