Executive brief
The SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules, contains a security flaw that allows unauthorized individuals to access its database. By sending a specially crafted web request, an attacker can view, modify, or delete sensitive information without needing a username or password. This could lead to the exposure of student or faculty data and the disruption of school operations.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/edit_rooma.php' file. The root cause is the improper neutralization of the 'id' GET parameter before it is used in a database query. A remote, unauthenticated attacker can exploit this by sending crafted HTTP requests to perform boolean-based blind, error-based, time-based blind, or UNION-based SQL injection attacks. Successful exploitation allows for unauthorized database access, data exfiltration, and potential full system compromise. No patch is currently documented, but remediation typically involves using prepared statements with parameterized queries.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-12: disclosed: Vulnerability reported on GitHub by user zzb1388
- 2026-07-18: advisory: NVD/VulDB advisory published