CVE-2026-11472: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

CVE-2026-11472 is a SQL injection flaw (CWE-89) affecting an unknown function within /index1.php of SourceCodester Class and Exam Timetabling System 1.0. The Password parameter fails to properly sanitize or parameterize user input before constructing SQL queries. This allows an attacker to inject arbitrary SQL commands. The attack vector is network-based with low complexity; no authentication or user interaction is required. The vulnerability results in confidentiality, integrity, and availability impact (CVSS 3.1 score 7.3, HIGH severity).

Business impact

Exploitation could allow attackers to access sensitive student and exam scheduling data, modify exam records, create unauthorized user accounts, or disrupt timetable operations. For educational institutions using this system, data breach exposure includes student personal information and institutional scheduling intelligence. The public availability of exploit code significantly increases the likelihood and speed of opportunistic attacks.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is the confirmed affected product. Organizations using this legacy application in any capacity should assume they are vulnerable. The application appears designed for educational institutions managing class schedules and exams, though exposure is not limited to that vertical.

Exploitability

This vulnerability is highly exploitable. Network accessibility requires no authentication, and attack complexity is low. Public exploit disclosure means attack tooling and methodologies are available to threat actors. Any internet-exposed instance is at immediate risk. The /index1.php endpoint is a common entry point in web applications, making discovery and targeting straightforward.

Remediation

Immediate action is required. Organizations should identify all deployments of SourceCodester Class and Exam Timetabling System 1.0. Given the age and apparent lack of active maintenance of this product, upgrading to a modern, actively maintained timetabling system is strongly recommended. If continued use is unavoidable, implement network segmentation to restrict access to the application, disable public internet exposure, and deploy a Web Application Firewall (WAF) with SQL injection detection rules. Monitor database activity for suspicious query patterns.

Patch guidance

SourceCodester has not released a patch for this vulnerability. Verify this directly with the vendor if you are an active licensee. The lack of official patching, combined with public exploit disclosure, indicates this product line may no longer receive security support. Prioritize migration to a maintained alternative. In the interim, layer compensating controls: WAF rules, input validation at application middleware, least-privilege database accounts, and strict network access controls.

Detection guidance

Monitor web server logs for /index1.php access patterns, especially requests containing SQL syntax characters in the Password parameter (single quotes, double dashes, keywords like UNION, SELECT, OR). Database query logs should be reviewed for unexpected commands or unusual user enumeration. Deploy WAF rules blocking common SQL injection payloads. Intrusion detection systems should flag anomalous database queries originating from the application's database account. Network segmentation detection will reveal unauthorized lateral movement attempts if exploitation succeeds.

Why prioritize this

HIGH priority remediation. The combination of network accessibility, no authentication requirement, public exploit disclosure, low attack complexity, and measurable data impact creates an acute risk. Educational institutions and any organization running this software faces imminent exploitation likelihood, particularly if internet-facing. This should rank in the top tier of vulnerability remediation queues.

Risk score, explained

CVSS 3.1 score of 7.3 reflects the network vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and confidentiality, integrity, and availability impact. The public availability of exploit code and broad network accessibility elevate practical risk beyond the base score. Organizations should treat this as a critical operational security issue requiring immediate action.

Frequently asked questions