CVE-2026-13487: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

The vulnerability is a SQL injection flaw (CWE-89) in the /archive.php endpoint, where the 'sy' parameter is not properly sanitized before being used in SQL queries. This falls under improper neutralization of special elements used in SQL commands (CWE-74). The attack vector is network-based with no authentication requirements, low attack complexity, and no user interaction needed. The compromised functionality remains within the system's integrity boundary, but allows unauthorized read, write, and delete operations against the database.

Business impact

Successful exploitation allows attackers to read sensitive data from the database, including student records, exam schedules, and administrative information. Attackers can also modify or delete records, disrupting educational operations and compromising data integrity. If the database contains personally identifiable information (PII) of students or staff, a breach could trigger regulatory compliance violations and reputational damage. Availability may also be affected if attackers delete critical scheduling data.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is vulnerable. Organizations running this specific application version should immediately inventory their deployments. The vulnerability is associated with the /archive.php file accessed via the 'sy' parameter. Version numbers for patched releases should be obtained directly from the vendor.

Exploitability

The vulnerability is highly exploitable. It requires no credentials, no user interaction, and can be triggered remotely over standard HTTP requests. The network attack vector combined with low complexity means an attacker with basic SQL injection knowledge can craft a malicious request. The public availability of exploit code significantly raises the likelihood of active exploitation in the wild. Organizations should assume this vulnerability will be actively targeted.

Remediation

Immediately upgrade SourceCodester Class and Exam Timetabling System to a patched version released after June 28, 2026. Verify the specific patch version number through the vendor's official advisory. As an interim measure, implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting /archive.php, particularly those manipulating the 'sy' parameter. Apply database-level access controls to limit what queries can execute and what data they can access.

Patch guidance

Contact SourceCodester or check their official website for available patches. The vendor released updates on or shortly after June 29, 2026. Verify patch version numbers against the official advisory before applying. Test patches in a non-production environment first to ensure compatibility with your configuration. Given the public availability of exploits, patching should be prioritized for immediate deployment.

Detection guidance

Monitor application logs for suspicious SQL syntax in requests to /archive.php, particularly those containing SQL keywords in the 'sy' parameter (e.g., UNION, SELECT, OR 1=1). Implement database activity monitoring to detect unusual query patterns or unauthorized access attempts. Search for HTTP requests with encoded SQL payloads targeting the /archive.php endpoint. Network intrusion detection systems should flag SQL injection signatures. Review authentication and authorization logs for unauthorized database modifications.

Why prioritize this

This vulnerability merits immediate attention due to its CVSS 3.1 score of 7.3 (HIGH severity), public exploit availability, and lack of authentication requirements. The remote network attack vector combined with no user interaction needed creates a low barrier to exploitation. SQL injection vulnerabilities directly enable data theft and system compromise. Educational institutions are frequent targets, and student data theft carries legal and reputational consequences.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a HIGH severity vulnerability due to the network attack vector (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction (UI:N). The vulnerability impacts confidentiality, integrity, and availability equally, indicating broad database compromise potential. The published exploit code and educational sector targeting increase real-world risk beyond the base CVSS score.

Frequently asked questions