CVE-2026-14641: SourceCodester Class and Exam Timetabling System SQL Injection Vulnerability

Technical summary

The vulnerability stems from improper input validation on the ID parameter in /edit_course.php. The application fails to sanitize or parameterize user-supplied input before incorporating it into SQL queries, enabling classic SQL injection attacks (CWE-89). The attack surface is exposed at the network boundary with no prerequisite authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 7.3). The flaw also involves improper handling of neutralization of special elements used in an SQL command (CWE-74), indicating a broader input validation weakness.

Business impact

Successful exploitation permits unauthorized access to sensitive academic and administrative data—student records, exam schedules, course information, and institutional metadata. Attackers can modify timetables, alter grades, or corrupt course assignments, disrupting institutional operations. The combination of confidentiality, integrity, and availability impact, coupled with public exploit availability and remote accessibility, elevates the risk of active exploitation in the wild. Institutions relying on this system face reputational damage, regulatory compliance violations, and operational chaos.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is confirmed affected. The vulnerability is triggered through the /edit_course.php file. Organizations using this software should inventory all deployments and assess network accessibility of affected instances.

Exploitability

Exploitation is straightforward: the vulnerability requires no authentication and can be triggered remotely by crafting a malicious HTTP request with a crafted ID parameter. Public disclosure of this vulnerability means proof-of-concept exploits and attack techniques are likely already circulating in attacker communities. The low complexity and lack of user interaction increase the probability of widespread opportunistic scanning and compromise attempts.

Remediation

Immediate patching is the primary remediation path; however, verify vendor advisory availability from SourceCodester for patched versions. Implement compensating controls if patching cannot be deployed immediately: apply strict input validation using allowlists for the ID parameter, enforce parameterized queries or prepared statements in the application, and restrict network access to /edit_course.php via firewall rules or web application firewalls (WAF). Database access controls and account separation can limit blast radius if injection succeeds.

Patch guidance

Contact SourceCodester or consult their official security advisory to confirm the availability and version number of patches addressing CVE-2026-14641. Once a patched version is released, apply it to all affected instances. Verify the patch by regression testing the ID parameter validation in /edit_course.php before full production deployment. If no patch is available from the vendor, prioritize the compensating controls outlined in the remediation section.

Detection guidance

Monitor database query logs for anomalous SQL patterns in requests originating from /edit_course.php, such as UNION-based or time-based injection indicators. Web application firewalls should be configured to detect and block SQL injection payloads in the ID parameter. Monitor for unexpected database user activity, privilege escalation queries, or data exfiltration. Network detection signatures should flag inbound requests to /edit_course.php containing SQL metacharacters (quotes, semicolons, comments) in the ID parameter. Check application logs for error messages or exceptions triggered by malformed SQL.

Why prioritize this

This vulnerability merits immediate remediation priority due to its HIGH CVSS score (7.3), public exploit availability, lack of authentication requirements, and direct impact on core institutional data. The combination of network-accessible exploitation, confirmed public disclosure, and data sensitivity creates a critical timeline for patch deployment or compensating controls.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a HIGH severity: the attack vector is network-based (AV:N), no special conditions are required (AC:L), no privileges or user interaction are needed (PR:N/UI:N), and the vulnerability impacts confidentiality, integrity, and availability within the affected scope (C:L/I:L/A:L). Public disclosure and proof-of-concept availability elevate real-world risk beyond the base score alone.

Frequently asked questions