SourceCodester's Class and Exam Timetabling System version 1.0 contains a classic SQL injection flaw in edit_room.php. By manipulating the ID parameter, attackers can inject arbitrary SQL statements, enabling unauthorized reading, modification, or deletion of database data. This leads to data compromise and is categorized as CWE-74 and CWE-89.

The only affected product is SourceCodester Class and Exam Timetabling System 1. as vulnerability is a classic SQL injection located in the edit_room.php file of SourceCodester Class and Exam Timetabling System version 1.0. By manipulating the ID parameter, a arbitrary SQL commands, allowing unauthorized reading, modification, or deletion of database records. The weakness stems from the concatenated into SQL queries, corresponding to CWE-74 and CWE-89.

The CVSS score of 6.9 indicates medium severity. The exploit is publicly available and can be launched remotely over the network. The EPSS score of < 1% points to a low probability of exploitation in the current environment, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the presence of a publicly available exploit warrants prompt attention.