CVE-2026-14732: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

CVE-2026-14732 is a network-accessible SQL injection flaw in the /edit_exam.php endpoint of SourceCodester Class and Exam Timetabling System 1.0. The application fails to properly sanitize the ID parameter before incorporating it into SQL queries, enabling an unauthenticated attacker to inject arbitrary SQL. The vulnerability maps to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output). With a CVSS v3.1 score of 7.3 (HIGH), the attack vector is network-based, requires low complexity, no privileges, and no user interaction—allowing direct exploitation.

Business impact

Organizations running this timetable management system face confidentiality, integrity, and availability risks. An attacker gaining database access could exfiltrate student records, staff schedules, or institutional data; alter exam assignments or class information; or render the system unavailable. In educational institutions, this could disrupt academic operations, compromise student privacy, and trigger regulatory compliance violations (FERPA, GDPR). The public availability of exploits means the window for safe patching is compressed.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is confirmed affected. Any installation of this version exposed to the network is at risk. Organizations should verify whether they are running version 1.0 and identify any internet-facing instances. Verify against the vendor advisory for information on whether later versions have addressed this issue.

Exploitability

This vulnerability is highly exploitable. No authentication is required, the attack complexity is low, and exploitation can be initiated remotely via standard HTTP requests. Public disclosure and availability of working exploits lower the bar for threat actors. The straightforward nature of SQL injection in URL parameters means both automated scanners and manual testing tools can easily trigger the flaw. Organizations should assume active exploitation is occurring or will occur imminently.

Remediation

Immediate action is required. Primary mitigation is to upgrade to a patched version provided by SourceCodester—verify the specific version number against the vendor advisory. As an interim measure, restrict network access to the /edit_exam.php endpoint using a Web Application Firewall (WAF) or network ACLs, or take the application offline if not critical to operations. Implement input validation and parameterized queries in the application code if patches are unavailable. Audit logs for signs of exploitation.

Patch guidance

Contact SourceCodester directly or check their official advisories for the recommended patched version. Apply patches during a maintenance window after thorough testing in a non-production environment. Verify the patch version number in official vendor documentation before deployment. After patching, restart the application service and confirm the /edit_exam.php parameter handling has been corrected through testing.

Detection guidance

Monitor for SQL injection attempts in HTTP requests to /edit_exam.php, particularly suspicious characters or SQL keywords in the ID parameter (e.g., quotes, semicolons, UNION, SELECT). Implement WAF rules to block common SQL injection payloads. Review web application access logs for unusual queries or repeated 40x errors that may indicate scanning. Database query logs may show anomalous SQL from the web application process. Intrusion detection systems (IDS) can flag SQL injection patterns in network traffic.

Why prioritize this

This vulnerability rates HIGH priority for any organization running version 1.0. The combination of remote exploitability, public exploit availability, no authentication requirement, and direct access to sensitive databases creates urgent risk. Educational institutions managing student data face heightened regulatory exposure. Patching or mitigating this flaw should be a top-tier task in the current remediation queue.

Risk score, explained

The CVSS 7.3 (HIGH) score reflects an easily exploitable network-accessible SQL injection with broad impact. The AV:N rating acknowledges remote exploitation; AC:L indicates no special conditions are needed; PR:N and UI:N confirm no authentication or user interaction is necessary. The CIA impact (Confidentiality, Integrity, Availability all Low in isolation) combined with the ease of exploitation justifies the HIGH severity. In practical terms, this is a critical-priority issue for affected deployments given public exploit availability.

Frequently asked questions