Executive brief
SourceCodester Class and Exam Timetabling System is a web application for managing academic scheduling and course administration. A SQL injection vulnerability in the course parameter allows remote attackers to manipulate database queries, potentially exposing sensitive academic and administrative data or modifying course records without authorization.
Technical details
The vulnerability is a classic SQL injection flaw in the /admin/modal_add_course1.php file, specifically in the mysqli_query function handling the course parameter. The affected endpoint is remotely reachable and does not appear to require authentication based on the attack vector description. An attacker can inject arbitrary SQL code through the course parameter to execute unauthorized database operations, including reading sensitive data or modifying the database structure and contents. Patches are not yet available; users should implement input validation and parameterized queries as a workaround.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-09-06: disclosed