A flaw exists in SourceCodester Class and Exam Timetabling System 1.0 that allows an attacker to inject arbitrary SQL commands through the `sy` argument in the file /archive3.php. The injection can be performed remotely and the public has released an exploit, meaning the vulnerability can be leveraged without local access or user interaction. Once executed, the attacker can read, modify or delete data stored in the database, compromising the confidentiality, integrity, and availability of the system.

SourceCodester's Class and Exam Timetabling System, version 1.0, is affected. No other vendors or products have been reported to be impacted by this vulnerability.

The vulnerability has a CVSS score of 6.9, indicating a moderate to high risk. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the description explicitly states the attack may be initiated remotely, and the presence of a public exploit increases the likelihood of usage. The CWE identifiers CWE‑74 (Untrusted Input) and CWE‑89 (SQL Injection) highlight the nature of the weakness. Given these factors, administrators should regard the vulnerability as significant and consider it an actionable threat.