Executive brief
SourceCodester Class and Exam Timetabling System is a web application used for managing academic class schedules and exam timetables. A SQL injection vulnerability in the course management feature allows remote attackers to execute arbitrary database queries, potentially exposing or modifying sensitive academic data without authentication.
Technical details
The vulnerability is a SQL injection flaw in the /admin/modal_add_course2.php file, specifically in the course parameter passed to the mysqli_query function. The vulnerable component fails to properly sanitize user input before incorporating it into SQL queries. An unauthenticated remote attacker can exploit this via the network by crafting malicious input in the course parameter to execute arbitrary SQL commands. This could result in unauthorized data access, modification, or deletion. A patch or fix status is not currently documented.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-09-06: disclosed