Executive brief
SourceCodester Class and Exam Timetabling System is a web-based application used to manage class schedules and exam timetables. A SQL injection vulnerability in the room management feature allows unauthenticated attackers to manipulate database queries through unsanitized input, potentially leading to unauthorized access to sensitive academic data, modification of exam schedules, or complete database compromise.
Technical details
A SQL injection vulnerability exists in the /modal_add_rooma.php file where the 'room_name' POST parameter is concatenated directly into mysqli_query() without proper input validation or prepared statements (vulnerable code around lines 59–60). The attack requires no authentication or special preconditions; an attacker can send a crafted POST request with malicious SQL syntax in the room_name field to execute arbitrary database commands. Time-based blind SQL injection has been demonstrated, allowing attackers to exfiltrate data, modify records, or achieve remote code execution depending on database permissions. Patches are not yet available; remediation requires implementing prepared statements and parameterized queries, strict input validation, and least-privilege database account permissions.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-07-20: disclosed: Vulnerability reported on GitHub
- 2026-09-06: advisory: CVE-2026-86209 published on NVD