A SQL injection flaw exists in the SourceCodester Class and Exam Timetabling System 1.0, triggered by manipulation of the Password argument in /index1.php. The flaw allows an attacker to inject arbitrary SQL statements into the application's database queries, potentially exposing sensitive data or altering database contents. The vulnerability is classified under CWE-74 (“Untrusted Search Path”) and CWE-89 (“Improper Neutralization of Special Elements used in a SQL Command”), underscoring that unsanitized input is being passed directly to the database layer.

This issue affects the SourceCodester Class and Exam Timetabling System, specifically version 1.0. No sub‑product or patch version is listed as unaffected, implying that any installed instance of 1.0 is potentially vulnerable. The flaw resides in index1.php, which likely handles authentication for the web application used by school administrators and students.

The CVSS score of 6.9 indicates moderate severity, but the vulnerability is exploitable remotely and publicly disclosed. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can send a crafted Password field over HTTP to manipulate the query. The lack of any mitigation in the affected release means that exploitation can be performed with little to no special conditions, making it a practical threat to any accessible instance.