The vulnerability is an unsanitized ID argument in the edit_room1.php script that allows an attacker to inject arbitrary SQL. By supplying a crafted value for the ID parameter, an attacker could read, modify, or delete data stored in the system database. The flaw aligns with CWE‑74 and CWE‑89. The description indicates the exploit can be performed from remote and it is inferred that no authentication controls protect the endpoint, meaning a remote attacker with network access to the web server could exploit the flaw.

SourceCodester Class and Exam Timetabling System is impacted. The vulnerability resides in the edit_room1.php handler of that application. No explicit version information is provided.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1 % suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the flaw can be triggered from any remote host that can reach the web server, and the public disclosure of the exploit means competent adversaries could attempt it at any time. Based on the description, it is inferred that the attack vector is over HTTP and does not require authentication, which increases the potential impact if a successful injection leads to data compromise.