A SQL injection vulnerability exists in edit_exam1.php, triggered by manipulating the ID parameter. The attacker can send crafted input remotely, leading to the execution of arbitrary SQL statements against the database. This can result in data disclosure, unauthorized modification, or deletion of records, and may affect the confidentiality, integrity, and availability of the system. The weakness involves improper handling of unsanitized input (CWE-74) and the embedding of user data in SQL queries (CWE-89).

SourceCodester Class and Exam Timetabling System (version 1.0) is affected, with the flaw located in the edit_exam1.php component of the application.

The CVSS EPSS of less than 1% shows a low likelihood of exploitation. The vulnerability is not listed in CISA KEV, but a published exploit and the ability to attack remotely raise the practical risk. Attackers can use the network to inject SQL, potentially compromising database contents and disrupting service.