CVE-2026-14733: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

CVE-2026-14733 is a remote, unauthenticated SQL injection flaw affecting SourceCodester Class and Exam Timetabling System 1.0. The vulnerability exists in the /edit_coursea.php endpoint where the ID parameter undergoes insufficient input validation before being incorporated into SQL queries. The attack vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating network accessibility with low attack complexity. The vulnerability maps to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-89 (SQL Injection), both indicating a lack of proper parameterization or escaping in database query construction.

Business impact

Exploitation of this vulnerability could allow attackers to extract sensitive student and course data, modify exam schedules or grades, or disrupt the integrity of the timetabling system. Educational institutions relying on this software may face operational disruption, regulatory compliance issues (particularly around student record protection), and reputational damage. The availability of public exploits significantly accelerates the timeline to widespread compromise.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is the confirmed affected product. Organizations using this system for managing course and exam scheduling are at direct risk. No patch version information is available in current advisories; verify the exact version deployed in your environment and contact the vendor for upgrade availability.

Exploitability

This vulnerability has a high exploitability profile. It requires no authentication, no user interaction, and minimal attack complexity—an attacker can craft a malicious HTTP request to the /edit_coursea.php endpoint with a specially crafted ID parameter. The fact that public exploits are available and documented significantly increases the likelihood of rapid weaponization and widespread scanning for vulnerable instances.

Remediation

Immediate action is required. First, identify all instances of SourceCodester Class and Exam Timetabling System 1.0 in your environment. Contact the vendor immediately for patch guidance and upgrade availability. If patching is not immediately possible, implement network-level controls to restrict access to the /edit_coursea.php endpoint and apply input validation rules at the web application firewall level to block common SQL injection patterns. Consider temporary disabling of the course editing functionality if operationally feasible.

Patch guidance

Check the SourceCodester vendor advisory and support channels for available patches or updated versions. Verify the version number of your deployment (typically found in application configuration or version files) and test any vendor-provided patches in a non-production environment before production deployment. If the vendor has released version 1.1 or later, prioritize upgrading to that version. Monitor vendor communications closely for any security bulletins related to this CVE.

Detection guidance

Monitor HTTP request logs for suspicious patterns targeting /edit_coursea.php, particularly requests containing SQL keywords or special characters (such as single quotes, dashes, comments, or UNION statements) in the ID parameter. Deploy Web Application Firewall (WAF) rules to detect and block SQL injection signatures. Review database query logs for unexpected or failed authentication attempts and unusual data access patterns. Search for any existing database access or modification events that may indicate prior compromise. Check for signs of data exfiltration in network traffic logs.

Why prioritize this

This vulnerability warrants immediate remediation due to its combination of high CVSS score (7.3), unauthenticated remote exploitability, availability of public exploits, and direct impact on educational data integrity. The lack of authentication or user interaction requirements means threat actors can automate attacks at scale. Organizations should treat this as a critical priority regardless of current KEV status.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH severity) reflects a remote attack vector, low attack complexity, no privilege requirements, no user interaction, and impact to confidentiality, integrity, and availability. While the scope remains unchanged, the combination of these factors—coupled with public exploit availability and the sensitivity of educational data—elevates practical risk beyond the numeric score.

Frequently asked questions