A flaw in SourceCodester Class and Exam Timetabling System allows manipulation of the ID argument in /edit_exam2.php to inject arbitrary SQL queries. The vulnerability is a classic SQL injection arising from missing input validation (CWE-74) and the use of string concatenation in SQL statements (CWE-89). Remote attackers can invoke the flaw by crafting requests to the web application, potentially accessing, modifying, or deleting data stored in the backend database, which compromises data confidentiality and integrity.

The affected product is SourceCodester Class and Exam Timetabling System. The vulnerability exists in the edit_exam2.php file. Versions of the product that contain the vulnerable code are not explicitly listed in the advisories, so any deployment of this system that includes the mentioned file is at risk.

The CVSS score of 6.9 indicates a moderate risk. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. Based on the description, the attack can be performed remotely by supplying a crafted ID parameter, and public exploits have already been released. The potential impact includes unauthorized data disclosure and modification. Due to the lack of a vendor patch in the public information, the risk remains significant for systems still using the vulnerable code.