Description

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The affected element is the function mysqli_query of the file /admin/modal_add_course.php. The manipulation of the argument course results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T18:17:23.150Z",
  "pubdate": "2026-09-06T18:17:23.150Z",
  "executiveSummary": "A SQL Injection vulnerability exists in the SourceCodester Class and Exam Timetabling System 1.0 within the /admin/modal_add_course.php file.\nThe vulnerability originates from the insecure handling of the 'course' argument when invoking the mysqli_query function.\nSuccessful exploitation allows a remote, unauthenticated, or authenticated attacker to execute arbitrary SQL commands against the underlying database.\nThis vulnerability poses a critical risk to data integrity and confidentiality, potentially enabling unauthorized access to administrative data, sensitive user information, or total database compromise.\nThe attack is remotely exploitable, requiring no complex preconditions beyond network access to the target application.\nDue to the public availability of exploit code, systems running version 1.0 are at immediate risk of exploitation by threat actors.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of special elements used in an SQL command within the /admin/modal_add_course.php script.\nSpecifically, the application utilizes the mysqli_query function to process user-supplied input from the 'course' argument without implementing sufficient input sanitization, parameterization, or prepared statements.\nThe attack flow begins when an attacker sends a crafted HTTP request to the target server, injecting malicious SQL syntax into the 'course' parameter.\nBecause the input is concatenated directly into the SQL query string before being executed by the MySQL database server, the injected commands are treated as part of the intended query logic.\nBy manipulating the SQL context, an attacker can bypass existing authentication mechanisms, alter query results, or execute destructive commands such as DELETE or DROP via stacked queries if the database configuration permits.\nPost-exploitation impact typically involves unauthorized data exfiltration, modification of application settings, or in some configurations, potential remote command execution if the database user possesses excessive privileges (e.g., FILE or superuser permissions).\nThe vulnerability is present in version 1.0 of the Class and Exam Timetabling System. The lack of parameterized queries (prepared statements) in the codebase serves as the primary failure point, allowing SQL injection via standard GET or POST vectors targeted at the vulnerable file.\nNetwork exposure is defined by the web application's reachability; an attacker need only reach the administrative endpoint to trigger the flaw."
}