The vulnerability exists in the preview4.php component of SourceCodester Class and Exam Timetabling System. By manipulating the course_year_section argument, an attacker can inject arbitrary SQL code into database queries. This leads to the ability to read, modify, or delete data stored in the system, compromising data confidentiality, integrity, and potentially availability.

SourceCodester’s Class and Exam Timetabling System version 1.0 is affected. The issue arises from an unknown function in preview4.php that processes the course_year_section argument without proper validation or sanitization.

The CVSS score of 6.9 indicates a moderate to high severity. The attack is remote and does not require local access, and it has been publicly disclosed. Since there is no EPSS score available and the vulnerability is not listed in CISA KEV, the likelihood of exploitation is uncertain but possible. Without a patch or mitigation, an attacker can leverage this SQL injection to gain unauthorized database access.