CVE-2026-13566: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

CVE-2026-13566 is a remote SQL injection vulnerability (CWE-89, CWE-74) in SourceCodester Class and Exam Timetabling System 1.0 affecting the /preview3.php endpoint. The course_year_section parameter is vulnerable to SQL injection due to insufficient input validation or parameterization. The CVSS 3.1 score of 7.3 (HIGH) reflects the network-accessible nature (AV:N), low complexity (AC:L), absence of privilege requirements (PR:N), and lack of user interaction (UI:N). The impact is limited to the affected system (S:U) with confidentiality, integrity, and availability impacts all scored as low (C:L/I:L/A:L), suggesting the injection may be constrained by database permissions or application context. The CWE-74 classification indicates improper neutralization of special elements in output, while CWE-89 directly addresses SQL injection.

Business impact

Exploitation could expose sensitive educational records including student information, grade data, and exam schedules. An attacker could modify timetables, alter grades, or corrupt scheduling data, causing operational disruption and undermining the integrity of academic records. While the CVSS impact scores are low, the reputational and compliance risks are substantial—academic institutions typically operate under privacy regulations (FERPA in the US, GDPR in Europe) that mandate protection of student data. Unauthorized access or modification could trigger breach notification requirements and regulatory scrutiny.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is confirmed affected. Organizations running this specific version on web-accessible servers are at immediate risk. The vulnerability is in the core /preview3.php file, meaning any deployment exposing this endpoint without additional network controls is vulnerable. Verify your installation version and deployment architecture; systems isolated behind properly configured firewalls or WAF rules may have reduced exposure.

Exploitability

The vulnerability is highly exploitable. It requires no authentication, no special user interaction, and can be triggered via standard HTTP requests. The presence of publicly available exploit code substantially lowers the barrier to attack. Attackers can craft malicious SQL queries in the course_year_section parameter to bypass security logic or extract data. No specialized knowledge or privileged access is needed. Given these factors, active exploitation in the wild is a realistic threat scenario, particularly for internet-facing instances.

Remediation

Immediate action is required. SourceCodester has not released a patched version in the available data; verify directly with the vendor for patch availability or security advisories. In the interim, implement emergency mitigations: disable or restrict access to /preview3.php via web server configuration or WAF rules, implement strict input validation and whitelist only expected course_year_section values, apply parameterized queries or prepared statements in the application code if you can modify the source, and deploy a WAF with SQL injection detection signatures. Consider upgrading to a maintained alternative if SourceCodester does not provide a security patch timeline.

Patch guidance

Check the SourceCodester project's official repository, website, or security advisories for patch availability. As of the vulnerability publication date (2026-06-29), verify whether a patch has been released and its version number. Apply patches in a staged manner: test in a non-production environment first, then deploy to production with a maintenance window. If no patch is forthcoming, prioritize the interim mitigations listed above and plan a migration strategy.

Detection guidance

Monitor web server and application logs for requests to /preview3.php containing SQL metacharacters (single quotes, double dashes, semicolons, UNION keywords, etc.) in the course_year_section parameter. Deploy network-based intrusion detection signatures targeting SQL injection patterns. Check database audit logs for unusual queries or failed authentication attempts that may indicate injection attempts. Implement request logging at the WAF level to capture suspicious payloads. Search your network for instances of this application version using asset inventory tools or port scanning.

Why prioritize this

This vulnerability merits immediate attention due to the combination of HIGH severity (CVSS 7.3), public exploit availability, zero authentication requirement, and remote exploitability. The absence of KEV designation does not diminish urgency—many actively exploited vulns predate KEV inclusion. Academic and institutional environments are attractive targets for data theft and operational disruption. Organizations should treat this as a critical security incident requiring rapid detection and remediation.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a high-severity vulnerability driven by attack vector (network), low attack complexity, and absence of privilege or interaction barriers. Impact scores are individually low (L), which may seem inconsistent with the overall HIGH rating; this likely reflects constraints imposed by database user permissions or application sandboxing rather than inherent weakness in the injection mechanism. In practice, the real-world impact can be substantial depending on the database configuration and data exposure scope. The public availability of exploit code further elevates practical risk beyond the base CVSS score.

Frequently asked questions