Executive brief
SourceCodester Class and Exam Timetabling System is a PHP-based educational management platform for scheduling classes and exams. A SQL injection vulnerability in the room management module allows unauthenticated attackers to inject malicious SQL commands, potentially exposing sensitive student and faculty data, modifying schedules, or disrupting system operations.
Technical details
A SQL injection vulnerability exists in the /modal_add_room2.php file where the 'room_name' POST parameter is concatenated directly into SQL queries without sanitization or parameterized statements (lines 59–60). The vulnerability is unauthenticated and remotely exploitable; no login or authorization is required. Attackers can craft malicious SQL payloads to extract database contents, modify data, or achieve database-level code execution. The time-based blind SQL injection has been confirmed with sqlmap. Remediation requires immediate implementation of prepared statements with parameter binding, strict input validation, and principle-of-least-privilege for database credentials.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-07-20: disclosed: Publicly disclosed on GitHub
- 2026-09-06: advisory: CVE-2026-86210 published to NVD