Executive brief
A security vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive school data or the modification of exam records. This attack can be carried out remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/edit_schoolyr.php' component. The root cause is the failure to properly sanitize or validate the 'id' GET parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending crafted SQL payloads (including boolean-based blind, error-based, and UNION-based techniques) to manipulate database queries. This can result in full database compromise, including unauthorized data extraction and modification. Public exploit code and proof-of-concept details are available.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-14: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-07-19: advisory: NVD/VulDB advisory published