Executive brief
SourceCodester Class and Exam Timetabling System is a web-based application for managing class schedules and exam timetables. An SQL injection vulnerability in the room management feature allows a remote attacker to manipulate database queries and potentially read, modify, or delete sensitive scheduling and administrative data without proper authorization.
Technical details
A SQL injection vulnerability exists in the /admin/modal_add_room.php file where user-supplied input to the room_name parameter is passed unsanitized to the mysqli_query function. The vulnerability is in the administrative backend of the timetabling system and requires network access to the admin interface. An attacker can inject arbitrary SQL commands through the room_name field to execute unauthorized database operations, potentially leading to data breach or unauthorized modification of system data. The vulnerability is marked as remotely exploitable and proof-of-concept code is publicly available.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-09-06: disclosed