Executive brief
SourceCodester Class and Exam Timetabling System is a web-based scheduling application for managing class and exam timetables. An SQL injection vulnerability in the course parameter allows remote attackers to manipulate database queries, potentially exposing or modifying sensitive student and course data, or disrupting timetable operations.
Technical details
The vulnerability is a classic SQL injection flaw in the /admin/modal_add_coursea.php file, specifically in the mysqli_query function handling the "course" parameter. An unauthenticated remote attacker can inject arbitrary SQL code by manipulating the course argument, bypassing input validation. This allows full database read/write access, enabling data extraction, modification, or deletion. The exploit has been publicly disclosed and is currently not known to be actively exploited in the wild.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-09-06: disclosed