CVE-2026-13485 SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

CVE-2026-13485 is a remote, unauthenticated SQL injection flaw in SourceCodester Class and Exam Timetabling System 1.0. The vulnerability exists in an unknown function handling the /preview.php endpoint, where the course_year_section parameter is passed unsafely to a SQL query without proper input validation or parameterized statements. This allows an attacker to craft malicious SQL payloads that execute arbitrary database commands. The weakness is classified under CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (SQL Injection), with a CVSS v3.1 score of 7.3 (HIGH), reflecting network-based exploitation, low attack complexity, and impact on confidentiality, integrity, and availability.

Business impact

Organizations using SourceCodester Class and Exam Timetabling System 1.0 face significant operational and data protection risks. An attacker exploiting this vulnerability could extract sensitive student records, course schedules, and institutional data; modify exam timetables or grades; or disrupt service availability. For educational institutions, this threatens student privacy, compliance with data protection regulations (FERPA, GDPR), and institutional reputation. The public availability of exploit details accelerates the likelihood of opportunistic attacks.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is affected. The vulnerability specifically impacts deployments where the /preview.php file is accessible and the course_year_section parameter is processed without sanitization. Any instance of this product exposed to untrusted network access is vulnerable.

Exploitability

This vulnerability is readily exploitable. It requires no authentication, no user interaction, and no special network conditions—only network connectivity to the affected endpoint. The attack vector is straightforward: craft a malicious SQL payload in the course_year_section parameter and send it to /preview.php. Public exploit code being available means the barrier to exploitation is very low, and both manual attackers and automated scanners can quickly identify and target vulnerable instances.

Remediation

Immediate action is required. First, verify whether your organization uses SourceCodester Class and Exam Timetabling System 1.0 and identify all exposed instances. Contact the vendor (SourceCodester) for a security patch or workaround. If an update is available, apply it urgently to all affected systems. As an interim measure, restrict network access to /preview.php using a Web Application Firewall (WAF) or firewall rules, and implement input validation to block SQL injection attempts. Consider disabling the system or taking it offline if patching is delayed and the risk is unacceptable.

Patch guidance

Check the SourceCodester vendor advisory and release notes for patched versions of Class and Exam Timetabling System that address CVE-2026-13485. Apply any available security patch immediately upon release. If the vendor has not yet released a patch, request an update timeline and implement the interim controls listed in remediation_summary. Document the patching timeline and monitor vendor communications closely.

Detection guidance

Monitor access logs for /preview.php and inspect the course_year_section parameter for SQL keywords (SELECT, UNION, DROP, INSERT, UPDATE, DELETE, etc.) or SQL metacharacters (single quotes, semicolons, comment sequences). Deploy a WAF rule to block requests containing common SQL injection payloads in this parameter. Use vulnerability scanners capable of detecting SQL injection to audit your instances. Monitor database query logs for unusual or malformed SQL statements that may indicate exploitation attempts.

Why prioritize this

This vulnerability ranks as HIGH priority due to remote exploitability, no authentication requirement, public exploit availability, and potential impact on confidentiality, integrity, and availability. For organizations running this timetabling system, it should be addressed within days, not weeks. The combination of ease of exploitation and sensitivity of educational data makes this a business-critical issue.

Risk score, explained

The CVSS v3.1 score of 7.3 (HIGH) reflects a network-accessible SQL injection with low attack complexity, no privilege or user interaction required, and measurable impact across confidentiality, integrity, and availability dimensions. The unscoped nature (S:U) and low barrier to exploitation (AC:L) drive the elevated severity. Public exploit code further increases practical risk beyond the base score.

Frequently asked questions