Description

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_user_account.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T10:17:15.330Z",
  "pubdate": "2026-09-06T10:17:15.330Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the Class and Exam Timetabling System version 1.0, specifically located within the /delete_user_account.php script.\nThe vulnerability arises from the improper sanitization of the 'ID' parameter, which is processed by the backend database layer without adequate validation or parameterized queries.\nThis flaw allows a remote, unauthenticated or authenticated attacker to inject arbitrary SQL commands, facilitating unauthorized data extraction, modification, or deletion from the underlying database.\nThe risk implication is severe, as the application's backend database is exposed to direct manipulation, potentially leading to full compromise of user data or administrative accounts.\nExploitation can be achieved remotely, and given the public disclosure of the exploit code, the system is at high risk of active targeting.\nThe impact includes, but is not limited to, unauthorized access to sensitive records, potential escalation of privileges, and complete loss of data integrity within the database environment.",
  "technicalDetails": "The vulnerability is a classic SQL Injection (SQLi) condition located in /delete_user_account.php. The root cause is the application's failure to utilize prepared statements or parameterized queries when handling user-supplied input via the 'ID' parameter.\nWhen a user triggers the deletion process, the 'ID' parameter is passed directly into an SQL statement executed against the database. Because the application fails to perform input validation or escape the input string, an attacker can manipulate the query structure by injecting malicious SQL fragments.\nThe attack flow typically involves the attacker crafting a malicious HTTP GET or POST request directed at /delete_user_account.php. By appending crafted SQL syntax to the 'ID' parameter—such as using union-based injection or boolean-based blind techniques—an attacker can alter the intended logic of the database query.\nFor instance, an attacker might inject payload strings designed to bypass authentication checks or force the database to return records from tables other than the one intended for user management. This allows the attacker to query the database schema, extract sensitive user information, or potentially modify administrative credentials if the database user's privileges are sufficiently broad.\nBecause the system performs the deletion logic server-side, the exploit does not require specialized client-side software beyond a standard web browser or an automated scripting tool like curl or SQLmap. The network exposure is broad, as any entity with reach to the web server can attempt to interact with the vulnerable file.\nThe technical manifestation indicates that the application likely constructs query strings through direct string concatenation. This allows an attacker to 'break out' of the intended SQL command context, effectively appending additional commands separated by SQL delimiters, such as semicolons, to execute arbitrary code or queries within the database engine.\nPost-exploitation, the impact is significant. Successful injection may grant the attacker unauthorized read or write access to the entire backend database, facilitating lateral movement or data exfiltration. Given that this component manages user accounts, it is highly probable that the database contains sensitive metadata that could be leveraged for further infrastructure compromise."
}