Description

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_product.php. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T21:17:22.567Z",
  "pubdate": "2026-09-06T21:17:22.567Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0, specifically within the /admin/modal_add_product.php file.\nThe vulnerability arises from the improper sanitization of user-supplied input provided via the fname argument before it is processed by the mysqli_query function.\nThis flaw allows a remote, unauthenticated, or authenticated attacker to inject arbitrary SQL commands into the application's database queries.\nSuccessful exploitation permits unauthorized access to sensitive information, database modification, or administrative bypass, depending on the privileges of the database user configured for the web application.\nGiven that the exploit has been publicly disclosed, the risk of automated or manual exploitation is high, necessitating immediate remediation to prevent data exfiltration or system compromise.",
  "technicalDetails": "The vulnerability is a classic SQL injection (SQLi) resulting from a failure to employ parameterized queries or adequate input validation within the /admin/modal_add_product.php component.\nThe application utilizes the mysqli_query function to execute database queries; however, the fname parameter is concatenated directly into the SQL statement without escaping or binding.\nAn attacker can manipulate the fname argument by injecting malicious SQL syntax, such as UNION-based payloads, error-based injection strings, or boolean-based blind injection patterns.\nThe attack flow proceeds as follows: 1) The attacker targets the /admin/modal_add_product.php endpoint with a crafted HTTP request (typically POST). 2) The malicious payload contained within the fname parameter is passed to the server-side script. 3) The server dynamically constructs a database query including the unsanitized input. 4) The database engine executes the altered query, effectively handing control of the database interaction over to the attacker.\nBy injecting specific SQL sequences, an attacker can bypass existing logical controls, extract the contents of the entire database—including user credentials and system configurations—or potentially modify data integrity through UPDATE or DELETE statements.\nThe vulnerability is remotely exploitable, meaning the attacker does not require local access to the server. The impact of this vulnerability is severe, as it grants full access to the backend database, potentially leading to a complete compromise of the underlying application data and, in certain configurations, server-side code execution or escalation of privileges."
}