A flaw in SourceCodester Class and Exam Timetabling System 1.0 allows an attacker to inject arbitrary SQL by manipulating the unsanitized ID parameter in the edit_coursea.php file. This can lead to reading, modifying, or deleting database records, thereby compromising confidentiality, integrity, and availability of the scheduling data. The weakness is identified as CWE‑74 (Improper Neutralization of Special Elements used in an SQL command) and CWE‑89 (SQL Injection).

The issue affects SourceCodester Class and Exam Timetabling System version 1.0, specifically the edit_coursea.php endpoint that processes the ID argument. No other versions or components are currently listed as impacted.

The CVSS score of 6.9 indicates a medium severity vulnerability that can be exploited remotely by sending a crafted request to the vulnerable endpoint. The EPSS score of less than 1 % suggests a low current likelihood of exploitation, although the exploit is publicly available. The vulnerability is not listed in the CISA KEV catalog. The CVE description states that the attack can be launched remotely; no information about authentication is provided, so the potential for exploitation depends on the exposure of the application to external users. Until a vendor patch or code fix is applied, the risk remains for any system that allows external access to edit_coursea.php.