CVE-2026-13521: SQL Injection in SourceCodester Timetabling System 1.0

Technical summary

CVE-2026-13521 is a remote SQL injection flaw affecting SourceCodester Class and Exam Timetabling System 1.0 in the /preview5.php endpoint. The vulnerable parameter 'course_year_section' fails to properly sanitize or parameterize user input before incorporating it into SQL queries. This maps to CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (SQL Injection), allowing an unauthenticated network attacker to execute arbitrary SQL commands. The CVSS 3.1 score of 7.3 (HIGH) reflects low attack complexity, no privileges required, no user interaction, and impacts to all three security pillars: confidentiality (data disclosure), integrity (data modification), and availability (denial of service).

Business impact

Organizations using SourceCodester's timetabling system face exposure of sensitive educational records, including student information, course schedules, and examiner assignments. Attackers could modify exam dates or student grades, disrupting academic operations. In educational institutions managing admissions or enrollment data, a successful exploitation could lead to regulatory compliance violations (FERPA in the US, GDPR in Europe) and reputational damage. The public availability of exploit code significantly increases the likelihood of opportunistic attacks.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is confirmed vulnerable. Organizations should verify whether deployed instances match this version. The vulnerability affects the /preview5.php file specifically, though a complete audit of similar files in the codebase is recommended to identify related injection points.

Exploitability

This vulnerability scores high on exploitability due to multiple factors: network accessibility (no VPN or special access required), no authentication prerequisite, no user interaction needed, and straightforward SQL injection techniques. Public exploit availability removes the barrier to entry for non-sophisticated attackers. Anyone with network access to the application can craft a malicious request to the vulnerable endpoint.

Remediation

Immediate actions: disable or restrict access to /preview5.php if it is not critical to operations; implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the course_year_section parameter. Long-term: upgrade to a patched version if available from SourceCodester (verify against the vendor advisory for the current secure release), or migrate to a maintained alternative timetabling platform. All input validation must use parameterized queries or prepared statements; input blacklisting alone is insufficient for SQL injection defense.

Patch guidance

Check the SourceCodester vendor advisory directly for the recommended patched version. Given the public exploit availability and HIGH severity, patching should be prioritized within 48–72 hours of vendor release. If SourceCodester has ceased maintenance of version 1.0, migration to a supported product is the only remediation path. Document the patching timeline and communicate it to stakeholders managing the affected system.

Detection guidance

Monitor web server logs for HTTP requests to /preview5.php containing SQL metacharacters (single quotes, semicolons, UNION, SELECT, DROP) in the course_year_section parameter. Deploy database activity monitoring (DAM) to detect unusual SQL query patterns or failed authentication attempts following the injection. Check error logs for SQL syntax errors, which often appear when injection attempts are blocked by input filters. Endpoint Detection and Response (EDR) tools should flag command execution spawned from the web application process.

Why prioritize this

This vulnerability merits immediate patching priority due to: (1) HIGH CVSS score reflecting multi-faceted impact, (2) zero authentication requirement lowering attacker barriers, (3) public exploit availability enabling mass scanning, (4) direct access to sensitive educational and personal data, and (5) potential for regulatory non-compliance. Educational institutions processing student data under FERPA or GDPR obligations face additional legal exposure.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) is driven by the combination of remote network accessibility, low attack complexity, absence of required privileges or user interaction, and broad impact across confidentiality, integrity, and availability. The score does not account for public exploit availability or the criticality of data typically stored in timetabling systems—factors that elevate practical risk beyond the base score.

Frequently asked questions