CVE-2026-13565: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

CVE-2026-13565 is a SQL injection flaw affecting SourceCodester Class and Exam Timetabling System 1.0. The vulnerability exists in /edit_class1.php where user-supplied input in the ID parameter is not properly sanitized before being incorporated into SQL queries (CWE-89). The underlying issue involves improper neutralization of special elements used in an SQL command (CWE-74). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L reflects network-accessible, low-complexity exploitation requiring no privileges or user interaction, with limited confidentiality, integrity, and availability impact.

Business impact

Successful exploitation could allow attackers to extract sensitive educational data—student records, grades, exam schedules, and personal information. Attackers may also modify or delete critical timetabling data, disrupting academic operations and causing service unavailability. Educational institutions relying on this system for class and exam scheduling face operational disruption, data breach liability, and potential regulatory consequences under data protection laws. Public disclosure increases the risk of opportunistic exploitation.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is affected. Organizations running this system in production should immediately audit deployment scope and identify all affected instances, particularly those exposed to the internet or untrusted networks.

Exploitability

This vulnerability has high exploitability characteristics: it requires no authentication, no user interaction, and can be triggered over the network through a simple HTTP request with a malicious ID parameter. Publicly disclosed exploit details lower the barrier to attack. However, actual exploitation complexity depends on target SQL injection filters (if any) and database query structure. Verify your specific deployment's susceptibility through testing before assuming complete compromise risk.

Remediation

Upgrade SourceCodester Class and Exam Timetabling System to a patched version that implements proper input validation and parameterized queries. Verify the exact patched version against the vendor's security advisory. Until patching is possible, implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the ID parameter, and restrict network access to /edit_class1.php using firewall rules or authentication controls.

Patch guidance

Contact SourceCodester or check their official repository for a security patch addressing SQL injection in /edit_class1.php. Apply patches in a test environment first to confirm functionality before production deployment. Verify that patched versions use parameterized queries (prepared statements) to neutralize SQL injection. If the vendor has not released a patch, escalate to the vendor's security team and consider migration to alternative, actively maintained timetabling systems.

Detection guidance

Monitor for HTTP requests to /edit_class1.php with suspicious ID parameters containing SQL keywords (UNION, SELECT, OR, --) or encoded equivalents (%27, %3D). Enable SQL query logging on your database to identify abnormal query patterns or failed authentication attempts originating from the web application. Use network IDS/IPS signatures targeting SQL injection payloads. Review web server and application logs for POST/GET requests to edit_class1.php with non-alphanumeric ID values.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.3) and warrants immediate attention due to unauthenticated remote exploitability, public disclosure, and direct access to sensitive educational data. The combination of no authentication requirements and network accessibility makes this a primary target for both automated scanning and human attackers. Educational institutions managing student data face both operational and compliance risk.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects the threat profile: Network-accessible (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). The vulnerability impacts confidentiality, integrity, and availability at limited scope (confidentiality and integrity compromise limited to unauthorized data access/modification; availability limited to potential service disruption). While not rated CRITICAL (which would suggest system-wide compromise), the lack of authentication and public disclosure elevate risk substantially.

Frequently asked questions