CVE-2026-14734: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

The vulnerability is a classic SQL injection flaw (CWE-89) combined with improper input neutralization (CWE-74) in the /edit_product.php endpoint. The ID argument passes unsanitized user input directly into SQL queries, allowing attackers to inject arbitrary SQL syntax. The CVSS 3.1 score of 7.3 (HIGH) reflects network-accessible exploitation with no authentication or user interaction required, yielding confidentiality, integrity, and availability impact. The availability of published exploits significantly increases real-world risk.

Business impact

Organizations deploying SourceCodester Class and Exam Timetabling System 1.0 face exposure of student records, exam schedules, and instructor data. Attackers can extract credentials, modify grades or timetables, or disable the application entirely. For educational institutions relying on this system for operations, such compromise disrupts scheduling, compromises data privacy (potentially triggering regulatory violations), and damages reputation. The low barrier to exploitation—no authentication required—means threat actors can act opportunistically.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is affected. The vulnerability resides specifically in /edit_product.php. Any instance accessible over a network is vulnerable. Verify your deployment version and confirm whether this legacy application is still in active use in your environment, as it may have been replaced by patched or redesigned alternatives.

Exploitability

Exploitability is straightforward and practical. The attack requires only network access and basic SQL injection knowledge; no valid credentials, special privileges, or user interaction are needed. Published exploit code lowers the skill floor, meaning script-based attacks are likely. CVSS vector AV:N/AC:L/PR:N/UI:N reflects this ease. Organizations should assume active reconnaissance and exploitation attempts are already occurring.

Remediation

Immediate action is required. Check whether your organization is running SourceCodester Class and Exam Timetabling System 1.0. If so, contact the vendor urgently to determine availability of patched versions or security updates. If no patch exists, isolate the application from untrusted networks, restrict access by IP allowlist, and consider disabling the /edit_product.php endpoint if functionality allows. As a longer-term measure, consider migrating to a modern, actively maintained timetabling solution with security-first design.

Patch guidance

Verify directly with SourceCodester for patched release availability and specific version numbers. Given the publication date of July 2026, check the vendor's security advisories and release notes for any 1.0.1 or higher versions explicitly addressing this SQL injection. Apply patches in a controlled test environment first to ensure compatibility with your exam schedules and data workflows before production deployment.

Detection guidance

Monitor /edit_product.php for suspicious HTTP requests containing SQL keywords (SELECT, UNION, OR, --, ;) in the ID parameter or other query strings. Log and alert on database errors or unexpected query patterns. Implement Web Application Firewall (WAF) rules to block common SQL injection payloads. Search historical logs for patterns matching published exploit signatures to identify potential prior breaches. Database query logging will reveal injected SQL if the application is already compromised.

Why prioritize this

This vulnerability warrants immediate prioritization due to the convergence of high CVSS severity (7.3), unauthenticated remote exploitability, published exploit availability, and the sensitive nature of educational data at risk. The lack of complexity and immediate practical threat make delay costly. While not yet listed in CISA's KEV catalog, the publication of working exploits means active weaponization is probable.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) accurately reflects a network-accessible SQL injection with no authentication barrier and confidentiality, integrity, and availability impacts. The presence of published exploits and the absence of KEV listing (as of the modification date) suggest awareness in attacker communities. For educational institutions or any organization using this system, the effective risk is higher due to data sensitivity and operational criticality; treat as critical priority regardless of the baseline score.

Frequently asked questions