Description

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects the function mysqli_query of the file /admin/modal_add_course2.php. Such manipulation of the argument course leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T20:17:28.117Z",
  "pubdate": "2026-09-06T20:17:28.117Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the Class and Exam Timetabling System 1.0. The vulnerability is located within the /admin/modal_add_course2.php file, specifically affecting the mysqli_query function.\nThis flaw allows remote, unauthenticated attackers to inject arbitrary SQL commands through the 'course' parameter. Successful exploitation enables unauthorized access to the backend database, potentially leading to the compromise of sensitive academic data, unauthorized modification of records, or full administrative control over the database management system.\nThe risk is high given the public availability of exploit code, allowing even low-skilled attackers to conduct malicious operations. Affected systems are immediately exposed to data breaches and integrity loss. Remediation is necessary to prevent unauthorized persistence and data exfiltration.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of special elements used in an SQL command within the /admin/modal_add_course2.php file. The application utilizes the 'course' parameter directly within a database query executed via the mysqli_query function without employing parameterized queries or sufficient input sanitization.\nThe attack flow begins when an attacker sends a crafted HTTP request to the vulnerable endpoint. By injecting malicious SQL syntax into the 'course' argument, the attacker can manipulate the structure of the database query executed by the application.\nWhen the application processes the input, the injected SQL payload is concatenated directly into the command string. For example, an attacker can append a UNION SELECT statement to retrieve data from other tables, or utilize boolean-based or error-based blind SQL injection techniques to enumerate database contents.\nBecause the system performs direct interaction with the MySQL database server using unfiltered user input, the application fails to distinguish between data and control plane instructions. This results in the database engine executing unintended operations specified by the attacker.\nThe vulnerability affects Class and Exam Timetabling System version 1.0. As this is a server-side vulnerability, the attacker does not require local access, and the attack can be executed remotely over a network. Depending on the configuration of the database user, the post-exploitation impact could include reading arbitrary files, writing web shells if file system permissions permit, or bypassing administrative authentication mechanisms entirely.\nThe lack of prepared statements (e.g., PDO or mysqli_stmt) is the primary architectural deficiency. The vulnerability is triggered during the POST request handling process where the application attempts to add course information, providing a clear vector for unauthorized database interaction."
}