Description

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This impacts the function mysqli_query of the file /admin/modal_add_coursea.php. Performing a manipulation of the argument course results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T20:17:28.280Z",
  "pubdate": "2026-09-06T20:17:28.280Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0, specifically within the /admin/modal_add_coursea.php file. The vulnerability stems from improper sanitization of the 'course' input argument before it is processed by the mysqli_query function. This flaw permits remote, unauthenticated or authenticated attackers to manipulate backend database queries, potentially leading to unauthorized data disclosure, modification, or deletion. Because the exploit is publicly available, the risk of exploitation is high. Successful exploitation grants attackers the ability to interact directly with the underlying database, bypassing application-level security controls and potentially compromising the integrity and confidentiality of the entire timetable management system.",
  "technicalDetails": "The vulnerability is located in the /admin/modal_add_coursea.php file, where user-supplied input via the 'course' parameter is passed directly into a SQL statement executed by the mysqli_query function without adequate validation or parameterized querying. This implementation follows the pattern of classic SQL injection, where malicious input is concatenated into the database query string, allowing the attacker to alter the query's logical structure.\nThe attack flow begins when an attacker sends a crafted HTTP request to the /admin/modal_add_coursea.php endpoint. By injecting SQL meta-characters and keywords into the 'course' argument, the attacker can manipulate the query execution context. For instance, an attacker could use UNION-based techniques to extract administrative credentials from the database, or blind SQL injection techniques to enumerate the database schema and contents character-by-character.\nBecause the system uses standard mysqli_query calls without utilizing prepared statements (parameterized queries), the database engine interprets the malicious input as executable code rather than literal data. This allows the attacker to execute arbitrary SQL commands with the privileges assigned to the database user configured for the application. If the database user possesses sufficient administrative rights, an attacker could escalate their access, dump sensitive user tables, or manipulate exam and scheduling data.\nThe vulnerability is exposed over the network, and the existence of public exploit code lowers the barrier to entry for adversaries. The technical impact is severe, as it facilitates full bypass of the application's authentication mechanisms and data access controls. Post-exploitation, an attacker can achieve persistence or perform complete data exfiltration, directly impacting the availability and integrity of the Class and Exam Timetabling System."
}