Description

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /delete_teacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T10:17:14.933Z",
  "pubdate": "2026-09-06T10:17:14.933Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the Class and Exam Timetabling System 1.0, specifically within the /delete_teacher.php component. The vulnerability arises from improper neutralization of user-supplied input passed through the ID argument. This flaw allows a remote, unauthenticated attacker to inject malicious SQL commands into the backend database queries.\nSuccessful exploitation of this vulnerability grants an attacker the ability to bypass security controls, leading to unauthorized data access, modification, or total compromise of the database management system. Given that the exploit vector is publicly disclosed, the risk of exploitation is significantly elevated. The system's integrity and confidentiality are at high risk, as the vulnerability is remotely accessible and does not explicitly require prior authentication to reach the vulnerable code path. Organizations utilizing this system are advised to treat this as a high-priority security issue, as it facilitates potential data exfiltration or administrative account takeover by manipulating backend query logic.",
  "technicalDetails": "The vulnerability is classified as an SQL injection (SQLi) flaw located within the /delete_teacher.php file of the Class and Exam Timetabling System 1.0. The root cause of the issue is the application's failure to perform adequate input validation and sanitization on the 'ID' parameter before incorporating it into a database query.\nDuring the standard operation of the delete_teacher.php script, the application receives a numerical or string-based identifier (ID) associated with a teacher record. The application proceeds to construct a SQL query intended to remove the specified entry from the database. Due to a lack of parameterized queries or prepared statements, the application concatenates the user-supplied 'ID' directly into the SQL command string. An attacker can manipulate this input by injecting standard SQL syntax, such as using single quotes, comments, or union-based operators, to alter the intended structure of the statement.\nThe attack flow proceeds as follows: First, the attacker identifies the /delete_teacher.php endpoint as a target. Second, the attacker crafts a malicious request containing a modified ID parameter, potentially appending commands such as 'OR 1=1' or 'UNION SELECT'. Third, the server-side interpreter processes the malformed query, executing the injected SQL commands alongside or instead of the original delete instruction.\nBecause the input is handled directly by the backend database engine, the attacker can leverage the SQL injection to probe the database schema, dump the contents of sensitive tables (such as user credentials, teacher information, or exam schedules), or perform administrative operations if the database user permissions are overly permissive. Since the exploit is remotely accessible, the attack does not require local network access or local host privileges. The vulnerability effectively turns the /delete_teacher.php script into an entry point for arbitrary database interaction, potentially leading to full administrative compromise if the application relies on the database for authentication state or session management."
}