The flaw resides in a function of edit_class.php in SourceCodester Class and Exam Timetabling System 1.0. By manipulating the ID argument, an attacker can inject SQL statements, allowing execution of arbitrary database commands. This vulnerability does not require local access and can compromise data confidentiality, integrity, and potentially lead to broader system compromise.

SourceCodester Class and Exam Timetabling System version 1.0. Only the /edit_class.php endpoint is affected. The impact is limited to the application’s database layer and does not extend to the underlying operating system or other services.

The CVSS score of 6.9 indicates medium severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no public weaponized exploitation yet. The attack vector is remote, relying on an attacker supplying a crafted ID parameter to inject SQL. Exploitation would require the application to be reachable over the network and to accept unauthenticated or weakly authenticated requests to edit_class.php.