CVE-2026-13526: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

CVE-2026-13526 is a SQL injection vulnerability (CWE-89, CWE-74) affecting SourceCodester Class and Exam Timetabling System 1.0. The vulnerability exists in /edit_class.php where the ID argument is not properly sanitized before being used in database queries. This allows an unauthenticated, remote attacker to execute arbitrary SQL commands via the vulnerable parameter. The CVSS 3.1 score of 7.3 (HIGH) reflects the network-exploitable nature, low complexity of exploitation, and confidentiality/integrity/availability impact. The absence of authentication requirements (PR:N) and user interaction (UI:N) makes this a significant risk.

Business impact

Organizations running this timetabling system face immediate risk of data breach, unauthorized modification of class schedules and exam records, and potential denial of service. Educational institutions relying on this system may experience disruption to scheduling operations, compromised student and staff information, and regulatory compliance violations if personal data is exposed. The published exploit code increases the likelihood of opportunistic attacks. Institutions should prioritize addressing this vulnerability to prevent unauthorized access to sensitive educational data.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is confirmed vulnerable. Other versions have not been explicitly identified in available sources; however, administrators should verify their exact version and consult the vendor for a complete product matrix. Affected deployments are those exposed to untrusted networks or accessible from the internet.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no user interaction, and can be triggered remotely over the network. Attack complexity is low—standard SQL injection techniques apply. The fact that functional exploit code has been published significantly increases practical exploit likelihood. Any system running the vulnerable version and accepting HTTP requests to /edit_class.php is at immediate risk.

Remediation

Immediately upgrade SourceCodester Class and Exam Timetabling System to a patched version released by the vendor. If an immediate patch is unavailable, implement network-level access controls to restrict requests to /edit_class.php to trusted hosts only. Apply input validation and parameterized query frameworks if patching is delayed. Audit database logs for signs of SQL injection attempts and verify the integrity of student records, class assignments, and exam schedules.

Patch guidance

Consult the SourceCodester vendor advisory to identify the patched version addressing CVE-2026-13526. Apply patches in a controlled test environment first to verify compatibility with existing data and integrations. Since this system manages educational records, coordinate patching with institutional scheduling and communication teams to minimize disruption. Verify patching by re-testing the /edit_class.php parameter handling for SQL injection after deployment.

Detection guidance

Monitor web application firewall (WAF) logs for suspicious SQL keywords (UNION, SELECT, DROP, etc.) in HTTP requests to /edit_class.php, particularly in the ID parameter. Review database access logs for unusual query patterns or failed authentication attempts originating from the application. Implement SQL injection detection rules in your WAF or intrusion detection system. Examine application error messages for SQL syntax errors in user-facing responses, which may indicate active exploitation attempts.

Why prioritize this

This vulnerability warrants immediate remediation. It combines high CVSS severity (7.3), network-exploitable attack surface, zero authentication barriers, published exploit availability, and direct access to sensitive educational data. The combination of low barrier to exploitation and significant business impact—particularly in educational environments handling student records—justifies prioritizing this above many other vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects a vulnerability with network accessibility (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction needed (UI:N). The impact assessment includes partial loss of confidentiality, integrity, and availability (C:L/I:L/A:L), as an attacker can read sensitive data, modify records, or trigger database errors causing service disruption. The absence of scope change (S:U) indicates the impact is limited to the vulnerable component. Published exploits and the educational nature of affected systems elevate practical risk beyond the base score.

Frequently asked questions