A vulnerability in the Class and Exam Timetabling System allows manipulation of the course_year_section parameter in preview3.php to inject arbitrary SQL. This flaw can enable an attacker to read, modify or delete data in the underlying database, potentially exposing sensitive academic records or altering timetables. The exploit is remote and the publicly available code suggests that an unauthenticated request can trigger the injection, creating a significant confidentiality risk.

SourceCodester Class and Exam Timetabling System version 1.0 is affected. The issue resides in the preview3.php script which processes the course_year_section argument. No other versions or components were identified as vulnerable in the provided data.

The CVSS score of 6.9 indicates a moderate level of severity. EPSS data is not available, so the exploitation probability is unknown, but the presence of publicly available exploit code implies a tangible threat. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely target the web interface remotely, sending crafted requests to the preview3.php endpoint to achieve injection.