Description

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /delete_subject.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T11:17:39.917Z",
  "pubdate": "2026-09-07T11:17:39.917Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0, specifically targeting the /delete_subject.php component.\nThe vulnerability arises due to improper sanitization of user-supplied input via the ID argument, allowing an unauthenticated remote attacker to inject arbitrary SQL commands.\nSuccessful exploitation permits unauthorized interaction with the backend database, potentially leading to unauthorized data disclosure, modification, or complete database compromise.\nGiven that the exploit is publicly available, the risk to organizations deploying this software is severe, as it allows attackers to bypass application-level access controls and execute malicious queries.\nThe flaw is remotely exploitable, requiring no prior authentication, and poses a significant threat to the integrity and confidentiality of the application's data layer.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located within the /delete_subject.php file of the SourceCodester Class and Exam Timetabling System 1.0.\nThe root cause is the insecure handling of the 'ID' parameter, which is processed by the application without adequate input validation or parameterized queries.\nWhen a user submits a request to the /delete_subject.php endpoint, the application takes the provided ID value and concatenates it directly into a SQL statement intended for the backend database management system.\nBy manipulating the ID parameter, an attacker can append malicious SQL syntax to the original query structure. Because the application fails to use prepared statements or robust escaping mechanisms, the injected SQL commands are parsed and executed by the database engine.\nThe attack flow begins with the attacker identifying the target endpoint and the vulnerable ID parameter. The attacker then crafts a malicious payload—such as a UNION-based or time-based injection string—to alter the logic of the underlying SQL query.\nFor example, an attacker could supply a payload that forces the database to return records from other sensitive tables, bypass authentication checks, or potentially execute administrative commands, depending on the database user's privileges.\nThe vulnerability is network-exposed, allowing any remote user to submit HTTP requests to the vulnerable script. No specific privileges or authentication tokens are required to reach the vulnerable code path, as the input handling occurs prior to session validation or within a script that lacks proper security constraints.\nThe impact of a successful exploitation is high; it enables the extraction of sensitive academic or scheduling data, modification of existing records, or potentially administrative access if the database configuration permits extended stored procedures.\nThe existence of public exploit code lowers the barrier for entry, allowing even low-skilled threat actors to weaponize this vulnerability against instances of the Class and Exam Timetabling System 1.0."
}