Description

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli_query of the file /admin/modal_add_course1.php. This manipulation of the argument course causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T19:17:27.943Z",
  "pubdate": "2026-09-06T19:17:27.943Z",
  "executiveSummary": "The Class and Exam Timetabling System version 1.0 is susceptible to a SQL injection vulnerability located in the /admin/modal_add_course1.php file. This flaw originates from the improper sanitization of user-supplied input passed to the mysqli_query function.\nThe vulnerability allows remote, unauthenticated, or authenticated attackers to manipulate database queries by injecting malicious SQL statements into the 'course' argument. Successful exploitation could lead to unauthorized data disclosure, modification, or complete compromise of the underlying database.\nGiven that an exploit has been publicly disclosed, the risk of active exploitation is significant. The vulnerability impacts the integrity, confidentiality, and availability of the system's data.",
  "technicalDetails": "The vulnerability resides within the /admin/modal_add_course1.php file in the Class and Exam Timetabling System 1.0. The root cause is the failure to implement adequate input validation or parameterization for the 'course' argument before it is concatenated into a raw SQL query string executed via the mysqli_query function.\nThe attack flow begins when an attacker sends a crafted HTTP request (typically POST) to the vulnerable endpoint. By supplying a specially crafted string containing SQL syntax—such as UNION SELECT statements, tautologies, or time-based blind SQLi payloads—within the 'course' parameter, the attacker effectively alters the intended logic of the SQL statement.\nSince the application directly embeds this input into the query, the database interpreter parses the malicious input as part of the command. For example, if the query is structured as 'INSERT INTO courses (course_name) VALUES ('$course')', an attacker can break out of the string literal using a single quote (') followed by additional SQL commands, potentially chaining comments to neutralize the remainder of the legitimate query.\nThis vulnerability is classified as a classic SQL injection. The impact of such an exploit is severe. Because the application interacts with a backend MySQL database, the attacker may gain the ability to bypass authentication mechanisms, dump sensitive information from the entire database schema, modify or delete critical records, or potentially gain administrative access to the system depending on the database user permissions.\nExploitation does not require advanced access if the file is reachable remotely, making it a high-risk vector for external attackers. The availability of published exploit code significantly lowers the barrier to entry for malicious actors, necessitating immediate remedial action to prevent data breaches."
}