A SQL injection vulnerability has been discovered in the SourceCodester Class and Exam Timetabling System. The flaw resides in an undisclosed function within /index2.php, where an attacker can manipulate the Password argument to inject arbitrary SQL statements. Successful exploitation can lead to unauthorized database access, allowing the attacker to read, modify, or delete sensitive data and potentially escalating to full database compromise.

Vulnerability affects the SourceCodester Class and Exam Timetabling System version 1.0. The product, originally distributed via SourceCodester, contains the faulty script at /index2.php. Users running this version are exposed to the risk unless a patch is applied.

The CVSS base score of 6.9 classifies this issue as moderate severity, signifying a significant threat when combined with remote exploitation capabilities. No EPSS score is available, but the public release of exploit code indicates a non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by sending a crafted HTTP request to index2.php with a malicious Password value; no authentication is required per the available description, making the attack vector low barrier.