CVE-2026-14772: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

The vulnerability is a classic SQL injection flaw (CWE-89) in the /edit_course1.php endpoint of SourceCodester Class and Exam Timetabling System 1.0. The ID parameter is passed unsafely to database queries without proper input validation or parameterized statement use. The affected function name is listed as unknown in vendor records, suggesting the codebase may lack clear documentation. The flaw also falls under CWE-74 (Improper Neutralization of Special Elements), indicating insufficient sanitization of user-controlled input before SQL execution. No authentication is required to trigger the vulnerability.

Business impact

Successful exploitation could allow an attacker to access, modify, or destroy course and exam timetable records in the database. For educational institutions using this system, this could result in course schedule corruption, unauthorized grade or enrollment modifications, student data theft, and operational disruption during critical scheduling periods. The impact extends to confidentiality, integrity, and availability of educational data. Reputational damage and potential regulatory exposure (FERPA, GDPR, local privacy laws) are secondary concerns depending on jurisdiction and student data classification.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is affected. The vulnerability is present in the /edit_course1.php file. Organizations running this exact version in production should assume exposure. The vendor product list is not populated in official sources, suggesting this may be an open-source or lesser-tracked solution; verify your deployment version against vendor advisory documentation.

Exploitability

This vulnerability scores 7.3 HIGH on CVSS v3.1 due to its network-accessible nature (AV:N), lack of authentication requirement (PR:N), low complexity (AC:L), and impact to confidentiality, integrity, and availability. Exploitation requires basic knowledge of SQL injection techniques and HTTP request manipulation—tools and payloads are readily available. Public disclosure increases the risk of automated scanning and weaponized exploitation. The vulnerability is not yet tracked in the CISA Known Exploited Vulnerabilities catalog, but public availability of exploit details removes a barrier to adoption by threat actors.

Remediation

Immediately apply vendor patches or upgrade to a version released after this disclosure. If patches are unavailable, implement input validation on the ID parameter (whitelist numeric or expected formats), use parameterized queries or prepared statements for all database interactions, and enforce principle of least privilege on database accounts. Deploy a Web Application Firewall (WAF) rule to block SQL injection payloads as a temporary layer. Conduct a database audit to detect unauthorized modifications or data exfiltration post-disclosure.

Patch guidance

Contact SourceCodester or check their official advisory portal for patched versions of Class and Exam Timetabling System. Verify patch applicability to version 1.0 specifically. If automatic updates are available, prioritize this patch in your maintenance window. Test patches in a non-production environment before production rollout to ensure compatibility with local customizations or data. If vendor support is unavailable or slow, consider evaluating alternative scheduling solutions.

Detection guidance

Monitor /edit_course1.php access logs for unusual ID parameter values, especially those containing SQL metacharacters (single quotes, dashes, semicolons, keywords like UNION, SELECT, DROP). Set up alerts for HTTP 400/500 errors on this endpoint, which may indicate injection attempt failures. Use database query logging to detect suspicious SQL patterns or unexpected table access from the application user account. SIEM rules should flag multiple rapid requests to /edit_course1.php with varying payloads, typical of automated exploitation scanning.

Why prioritize this

This vulnerability merits immediate attention because it is network-exploitable without authentication, has been publicly disclosed, impacts data confidentiality and integrity, and affects an educational timetabling system likely managing sensitive student and course data. The HIGH CVSS score reflects the combination of easy access and broad impact. Organizations using version 1.0 should treat this as critical until patched.

Risk score, explained

CVSS 7.3 reflects a high-risk vulnerability: remote network access (AV:N) with no authentication barrier (PR:N) makes it trivial to reach. Low attack complexity (AC:L) means attackers need no special conditions or timing. The impact to confidentiality, integrity, and availability (C:L, I:L, A:L) means an attacker can read database records, modify timetables or grades, and potentially delete data, affecting all three security pillars. The score would be 9.8 CRITICAL if system-level impact (S:C) were present, but isolation to the application scope keeps it at HIGH.

Frequently asked questions