CVE-2026-13488: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

CVE-2026-13488 is a remote, unauthenticated SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The vulnerability resides in /preview7.php, where insufficient input sanitization on the 'course_year_section' parameter allows an attacker to inject malicious SQL queries. The affected endpoint accepts network requests without authentication (AV:N, PR:N), and exploitation requires no special conditions (AC:L, UI:N). The attack vector is CWE-89 (SQL Injection) combined with CWE-74 (Improper Neutralization of Special Elements in Output). The CVSS 3.1 score of 7.3 (HIGH severity) reflects the broad attack surface and confidentiality, integrity, and availability impact.

Business impact

Organizations deploying SourceCodester Class and Exam Timetabling System 1.0 face direct risks to educational data integrity and student privacy. Attackers can extract student records, exam schedules, grades, and personally identifiable information without credentials. Database modification could corrupt course schedules or enrollment data, disrupting academic operations. In regulated environments (FERPA, GDPR), unauthorized data access incurs compliance violations and potential fines. Because exploit code is public, opportunistic actors are likely probing for vulnerable instances, elevating the urgency of remediation.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is affected. The vulnerability is specifically triggered through the /preview7.php endpoint when the 'course_year_section' parameter is supplied. Any deployment of this software version exposed to network traffic is at risk. Legacy or offline-only installations with no internet-facing endpoints would not be exploitable, but verifying deployment scope is critical.

Exploitability

The vulnerability is highly exploitable. It requires no authentication, no user interaction, and no complex conditions; a simple HTTP request with a malicious payload in the 'course_year_section' parameter is sufficient. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) confirms minimal barriers to attack. Critically, exploit code has been released publicly, meaning attackers with limited technical skill can immediately weaponize the flaw. Shodan, Censys, or other asset discovery tools can identify exposed instances, making large-scale scanning and exploitation probable.

Remediation

Immediate action is required: verify whether your organization runs SourceCodester Class and Exam Timetabling System 1.0. If deployed, check the vendor advisory for a patched version and plan an expedited upgrade. Until patching is possible, implement network-level controls: restrict access to /preview7.php to trusted internal IPs only, disable the endpoint if not actively used, or place a Web Application Firewall (WAF) rule to block requests containing SQL metacharacters in the 'course_year_section' parameter. These controls reduce exploitability but are not substitutes for patching.

Patch guidance

Contact SourceCodester or check their official website for security updates addressing CVE-2026-13488. Verify the patch version against the vendor's security advisory to confirm it remediates this specific SQL injection in /preview7.php. Test patches in a non-production environment before deployment. Given the public availability of exploit code, patching should be prioritized within 48–72 hours if the system is internet-facing. If the vendor has not released a patch, escalate internally and consider alternative software.

Detection guidance

Monitor access logs for HTTP requests to /preview7.php with suspicious patterns in the 'course_year_section' parameter, such as SQL keywords (SELECT, UNION, DROP, etc.), comment syntax (--, /* */), or URL-encoded equivalents (%53%45%4C%45%43%54). Deploy an IDS/IPS rule to detect SQL injection payloads. Enable database query logging to identify unusual or unauthorized queries. Use SIEM tools to correlate web server and database logs, alerting on failed or successful authentication attempts following suspicious web requests. Assume breach and review logs for the past 30 days to detect prior exploitation.

Why prioritize this

This vulnerability warrants immediate, high-priority remediation due to: (1) public exploit availability, enabling mass exploitation; (2) no authentication required, lowering attacker barriers; (3) direct impact on confidentiality, integrity, and availability; (4) educational data sensitivity and regulatory exposure; (5) CVSS 7.3 HIGH severity score. Organizations should treat this as a critical incident if the software is deployed and reachable from the internet.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a HIGH-severity vulnerability because it combines a network-accessible endpoint (AV:N), low attack complexity (AC:L), no authentication (PR:N), no user interaction (UI:N), and broad impact across confidentiality, integrity, and availability (C:L, I:L, A:L). The score does not account for the fact that exploit code is public and actively circulating, which in practical risk terms elevates the real-world threat beyond the numerical score. Organizations should treat public exploit availability as a force multiplier.

Frequently asked questions