Description

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_user.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T10:17:15.163Z",
  "pubdate": "2026-09-06T10:17:15.163Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0, specifically within the /delete_user.php script.\nThe vulnerability arises from improper neutralization of input parameters, allowing an unauthenticated or authenticated attacker to inject arbitrary SQL commands via the 'ID' argument.\nSuccessful exploitation permits unauthorized access to the underlying database, potentially leading to data exfiltration, modification, or deletion of administrative accounts.\nThe flaw is remotely exploitable, and given the public availability of functional exploit code, the risk of active exploitation is significant.\nThis vulnerability compromises the integrity and confidentiality of the entire database backend, posing a severe threat to the operational stability of the application.\nImmediate remediation is required to sanitize all user-supplied inputs and enforce robust database interaction standards.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in the /delete_user.php file of SourceCodester Class and Exam Timetabling System 1.0.\nThe root cause is the failure of the application to properly sanitize or parameterize the 'ID' argument before passing it into a database query.\nWhen a request is made to /delete_user.php, the script processes the 'ID' parameter without sufficient validation, allowing an attacker to escape the intended query structure.\nBy manipulating the 'ID' input, an attacker can append malicious SQL syntax, effectively altering the logic of the backend SQL statement to bypass authentication, reveal administrative credentials, or dump the entire database contents.\nThe attack flow typically involves sending a crafted HTTP GET or POST request to the vulnerable endpoint with an injected payload in the 'ID' field, such as a UNION-based or time-based blind SQL injection vector.\nBecause the application does not utilize prepared statements or parameterized queries, the database engine executes the injected SQL commands with the same privileges as the application’s database user account.\nThe exploit is accessible remotely, meaning an adversary does not require physical access to the server or local network infrastructure to initiate the attack.\nPost-exploitation impacts include the potential for full administrative takeover, unauthorized data retrieval of system users, and the compromise of academic or scheduling data managed by the system.\nThe absence of input validation and the direct concatenation of unsanitized input into dynamic SQL strings represent a significant security failure in the application architecture, rendering it highly susceptible to standard SQLi attack vectors."
}