Executive brief
SourceCodester's Class and Exam Timetabling System is a web-based application for managing class schedules and exams. A SQL injection vulnerability in the edit_teacher.php file allows unauthenticated attackers to manipulate database queries, leading to unauthorized access to sensitive educational data, modification of records, or complete compromise of the system.
Technical details
A SQL injection vulnerability exists in the /edit_teacher.php file where the 'id' parameter is directly concatenated into SQL queries without proper input validation or parameterized queries. The vulnerability is accessible via GET requests and requires no authentication. Attackers can inject various SQL payloads (boolean-based blind, error-based, time-based blind, UNION-based) to extract database contents, modify data, or escalate privileges. The root cause is insufficient input sanitization of user-supplied parameters. Patches should implement prepared statements with parameter binding and strict input validation.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-09-04: disclosed: Vulnerability disclosed on GitHub
- 2026-08-15: advisory: CVE-2026-19899 published