Description
A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_room.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a classic SQL injection located in the edit_room.php file of SourceCodester Class and Exam Timetabling System version 1.0. By manipulating the ID parameter, a remote attacker can inject arbitrary SQL commands, allowing unauthorized reading, modification, or deletion of database records. The weakness stems from the fact that input is not validated and is directly concatenated into SQL queries, corresponding to CWE-74 and CWE-89.

Affected Systems

The only affected product is SourceCodester Class and Exam Timetabling System 1.0. No other releases or variants are reported as impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. The exploit is publicly available and can be launched remotely over the network. The EPSS score of < 1% points to a low probability of exploitation in the current environment, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the presence of a publicly available exploit warrants prompt attention.

Generated by OpenCVE AI on July 23, 2026 at 15:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SourceCodester Class and Exam Timetabling System to a version that contains the vendor‑supplied fix for the edit_room.php injection.
  • Patch the application by replacing the vulnerable ID handling with a prepared statement or other parameterized query approach; additionally enforce that the ID parameter is an integer before it reaches the SQL layer.
  • Restrict access to the /edit_room.php endpoint so that only authenticated administrators can invoke it, and apply role‑based access controls to limit exposure.

Generated by OpenCVE AI on July 23, 2026 at 15:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_room.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Title SourceCodester Class and Exam Timetabling System edit_room.php sql injection
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Class And Exam Timetabling System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:49:36.018Z

Reserved: 2026-07-05T04:01:30.413Z

Link: CVE-2026-14770

cve-icon Vulnrichment

Updated: 2026-07-06T16:45:49.174Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-23T15:45:02Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')