The flaw permits a classic SQL injection by altering the ID argument in the edit_product.php file. Because the application concatenates the ID value directly into a SQL statement, an attacker can embed arbitrary SQL commands, permitting read, modification or deletion of database records, a CWE‑74 and CWE‑89 weakness.

SourceCodester: Class and Exam Timetabling System 1.0 contains the vulnerable code within edit_product.php. No other product variants or component updates were identified in the data. The vulnerability affects the web interface that processes the ID parameter, and consequently any function that relies on this script.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation. Remote exploitation has been published, yet the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over the web, as the vulnerable script is a PHP endpoint accessible via HTTP requests.