A SQL injection vulnerability exists in edit_exam1.php, triggered by manipulating the ID parameter. The attacker can send crafted input remotely, leading to the execution of arbitrary SQL statements against the database. This can result in data disclosure, unauthorized modification, or deletion of records, and may affect the confidentiality, integrity, and availability of the system. The weakness involves improper handling of unsanitized input (CWE-74) and the embedding of user data in SQL queries (CWE-89).

SourceCodester Class and Exam Timetabling System (version 1.0) is affected, with the flaw located in the edit_exam1.php component of the application.

The CVSS score of 6.9 combined with an EPSS score of less than 1% indicates a moderate severity but a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, yet a publicly available exploit and the explicit statement that it can be launched remotely increase the practical risk. Attackers can send crafted requests to the edit_exam1.php endpoint, injecting SQL via the ID parameter, which may allow unauthorized data disclosure, modification, or deletion in the underlying database.