CVE-2026-14771: SourceCodester Timetabling System SQL Injection Vulnerability

Technical summary

CVE-2026-14771 is a remote SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System 1.0. The vulnerability exists in the /edit_exam1.php endpoint where user-supplied input in the ID parameter is passed directly into SQL queries without proper sanitization or parameterized statement usage. The flaw maps to CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output), indicating both direct injection and output encoding failures. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects network-accessible exploitation, low attack complexity, no privilege requirements, and impact across confidentiality, integrity, and availability.

Business impact

Organizations using this timetabling system face direct data breach risk, as attackers can extract sensitive information including student records, exam schedules, and potentially instructor credentials. Integrity compromise allows unauthorized modification of exam data and academic records, creating compliance violations and operational chaos. System availability may degrade or collapse if the database is corrupted or deleted. The reputational damage from academic data theft or fraudulent grade modification extends beyond IT operations to institutional credibility.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is confirmed affected. The vulnerability specifically impacts the /edit_exam1.php file. Organizations should verify all instances of this application in their environment, including development, staging, and production deployments. Instances may exist in educational institutions, training centers, or any organization managing exam scheduling.

Exploitability

This vulnerability is highly exploitable. No authentication is required, attack complexity is low, and exploitation can be conducted entirely remotely via HTTP requests. Public exploit code has already been published, lowering the bar for attackers with minimal technical skill. An attacker can craft a single malicious URL or POST request to extract database contents, modify records, or execute arbitrary SQL commands. The combination of network accessibility, published exploits, and absence of KEV status (not yet on CISA's Known Exploited Vulnerabilities catalog) suggests active scanning and exploitation attempts are already underway or imminent.

Remediation

Immediate action is required. Organizations should isolate affected instances from production networks if patches are unavailable, or apply vendor updates as soon as released. Input validation and parameterized prepared statements must replace concatenated SQL query construction. Apply web application firewall rules to detect and block SQL injection patterns in the ID parameter. Consider decommissioning unsupported versions of the application in favor of maintained alternatives. Verify database access controls and implement least-privilege principles for application database accounts.

Patch guidance

Verify availability of patches from SourceCodester directly, as no specific patch version numbers are provided in vendor advisories at this time. Contact SourceCodester support or check their security advisory pages for version 1.0 fixes. If patches are delayed, implement compensating controls such as WAF rules targeting SQL injection signatures, database query whitelisting, and network segmentation. Do not delay remediation waiting for perfect patches—layered mitigation should begin immediately.

Detection guidance

Monitor access logs for /edit_exam1.php requests with unusual ID parameter values containing SQL keywords (UNION, SELECT, OR, comment characters, quote variations). Look for HTTP 400/500 errors clustered around this endpoint, which may indicate injection testing. Enable database query logging to detect unusual commands such as data exfiltration queries (SELECT INTO) or administrative commands (DROP, ALTER). Implement SIEM correlation rules for multiple failed requests followed by successful execution, a pattern typical of SQL injection exploitation.

Why prioritize this

This vulnerability merits immediate priority due to the convergence of high CVSS score (7.3), published exploits, unauthenticated remote access, and direct impact on confidential academic and administrative data. Educational institutions managing exam records are high-value targets. The absence of complex attack prerequisites and the existence of public PoC code mean this threat is likely to be weaponized widely and quickly.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects a network-accessible vulnerability with low attack complexity and no privilege requirements. The vector shows partial impact to confidentiality (data theft), integrity (data modification), and availability (resource consumption or deletion). While not rated as CRITICAL, the high score is appropriate given the combination of easy exploitation and sensitive data at risk in academic environments. Organizations in regulated sectors (FERPA, GDPR) face additional compliance risk that elevates business priority beyond the CVSS number alone.

Frequently asked questions