CVE-2026-11485: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

The vulnerability exists in an unknown function within /archive2.php where the 'sy' parameter is processed without proper input validation or parameterized query mechanisms. This unsafe handling allows attackers to inject arbitrary SQL syntax, violating CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output). The attack vector is network-based with low complexity, no privilege requirements, and no user interaction needed. CVSS v3.1 score of 7.3 (HIGH) reflects moderate impact across confidentiality, integrity, and availability dimensions.

Business impact

Successful exploitation could expose student records, instructor information, and timetabling data stored in the application database. An attacker may read sensitive information, modify academic records or schedules, or delete data entirely. For institutions relying on this system for operational scheduling, such compromise could disrupt class administration and damage institutional credibility. The combination of low attack complexity and public disclosure increases business risk significantly.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is affected. Any installation of this application accessible over a network is at risk if not patched or properly isolated. Given the application's educational focus, affected organizations likely include schools, universities, and training centers using this system for academic scheduling.

Exploitability

This vulnerability is highly exploitable. The attack requires only network access—no authentication, no special privileges, and no user interaction. The parameter manipulation is straightforward, and public disclosure means proof-of-concept or attack tools may be readily available or under development. Organizations should assume active exploitation attempts are already occurring or imminent.

Remediation

Verify availability of patches directly from SourceCodester and apply immediately. If patches are unavailable, implement input validation and parameterized queries (prepared statements) in /archive2.php to sanitize the 'sy' parameter. Apply web application firewalls (WAF) with SQL injection detection rules as a temporary mitigation. Restrict network access to /archive2.php where operationally feasible. Review database logs for signs of exploitation attempts or successful injections.

Patch guidance

Contact SourceCodester directly for patch availability and version information for Class and Exam Timetabling System 1.0. Verify patch details against the vendor advisory before deployment. Test patches in a non-production environment to ensure compatibility with institutional workflows. Once verified, deploy to all instances of the application without delay. Maintain change logs documenting patch dates and versions across all installations.

Detection guidance

Monitor web server logs for suspicious requests to /archive2.php containing SQL syntax characters (e.g., quotes, semicolons, UNION, SELECT, DROP) in the 'sy' parameter. Deploy database query monitoring to detect anomalous SQL activity from the application. Implement WAF rules blocking common SQL injection payloads. Query database audit logs for unauthorized data access, modification, or deletion events. Check for unexpected stored procedures or user accounts created post-compromise.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of HIGH CVSS severity, public disclosure, network-based exploitability requiring no authentication, and the sensitive nature of educational records. The lack of KEV listing does not reduce urgency—public disclosure itself indicates active threat potential. Organizations using this system should treat patching or mitigation as a critical operational priority.

Risk score, explained

The CVSS v3.1 score of 7.3 reflects a HIGH-severity vulnerability. The score is driven by the network attack vector (AV:N), low attack complexity (AC:L), lack of privilege requirement (PR:N), and absence of user interaction (UI:N). While impact is moderate rather than complete (L for confidentiality, integrity, and availability), the ease and remoteness of exploitation, combined with public disclosure, elevates practical business risk significantly above the base score alone.

Frequently asked questions