CVE-2026-14642 SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

CVE-2026-14642 is a remote SQL injection flaw (CWE-89, CWE-74) affecting SourceCodester Class and Exam Timetabling System 1.0. The vulnerability exists in /edit_class2.php where user-supplied input in the ID parameter is not properly sanitized before being incorporated into SQL queries. The CVSS 3.1 score of 7.3 (HIGH) reflects the network-based attack vector, low complexity, and lack of required privileges or user interaction. The vulnerability enables confidentiality, integrity, and availability compromise of the underlying database.

Business impact

Exploitation of this SQL injection could allow attackers to extract sensitive educational data (student records, grades, schedules), modify class assignments or timetables, or delete database records. Organizations using this system for exam scheduling and class management face operational disruption, data breach liability, and potential regulatory exposure if student or staff information is compromised. The availability of public exploit code elevates the likelihood of opportunistic attacks.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is affected. Organizations using this self-hosted or on-premise educational management system are in scope. The vulnerability is not version-specific beyond 1.0; verify whether newer versions have been released and whether your deployment matches the affected version.

Exploitability

This vulnerability is easily exploitable. It requires only network access to the /edit_class2.php endpoint—no authentication, user interaction, or special conditions are needed. Public exploit code is available, meaning attackers have ready-made tools to probe and compromise affected systems. The low complexity and high accessibility make this a priority target for automated scanning and attacks.

Remediation

Immediate action is required. Contact SourceCodester or check their vendor website for a patched version. If no patch is available, consider implementing Web Application Firewall (WAF) rules to filter SQL injection patterns in the ID parameter, restricting network access to /edit_class2.php to trusted networks, or temporarily taking the application offline if it is not critical. Input validation and parameterized queries must be enforced in any code update.

Patch guidance

Verify the latest version of SourceCodester Class and Exam Timetabling System against the vendor's official advisory or download page. Apply updates according to the vendor's release notes. If the vendor has not released a patch, request an estimated timeline and implement compensating controls (network segmentation, WAF rules, access restrictions) while awaiting an update.

Detection guidance

Monitor web server logs and database logs for suspicious SQL queries, unusual characters in URL parameters (such as quotes, semicolons, UNION keywords), and failed SQL statements. Search for requests to /edit_class2.php with encoded or raw SQL syntax in the ID parameter. Configure intrusion detection signatures for SQL injection payloads. Review database access logs for unexpected queries or data extraction patterns.

Why prioritize this

This vulnerability merits urgent remediation due to the convergence of high CVSS score (7.3), public exploit availability, minimal attack complexity, and the lack of authentication barriers. Educational institutions managing sensitive student data face significant operational and compliance risks. The broad impact potential (confidentiality, integrity, availability) and ease of exploitation justify prioritization above many other vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a HIGH severity rating. The network attack vector (AV:N) and no privilege requirement (PR:N) indicate broad accessibility. Low attack complexity (AC:L) and no user interaction (UI:N) mean attackers can exploit this reliably and automatically. The scoped-unchanged model (S:U) applies the impact to the vulnerable component's resources. Low impact values for confidentiality, integrity, and availability (each L) account for partial compromise—the attacker can read, modify, or disrupt database records but may not achieve complete system takeover. The convergence of accessibility and impact justifies the HIGH rating.

Frequently asked questions