Executive brief
SourceCodester Class and Exam Timetabling System is a PHP-based application used to manage school class schedules and exam timetables. A missing authorization check in the admin session handling allows attackers to bypass authentication and manipulate the system remotely without valid credentials, potentially compromising schedules, student data, and system integrity.
Technical details
The vulnerability is an authorization bypass in /admin/session.php where manipulation of the ID parameter bypasses access controls. The flaw allows unauthenticated attackers to access admin functionality remotely without proper session validation or permission checks. Reference materials indicate SQL injection also exists in /modal_add_room1.php via the room_name parameter, suggesting broader input validation issues across the application. No patch has been publicly released; administrators should upgrade from version 1.0 or implement strict input validation and authentication controls.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-09-04: disclosed: CVE-2026-85512 published
- 2026-07-20: other: SQL injection variant reported on GitHub