The vulnerability resides in the edit_subject.php component of SourceCodester Class and Exam Timetabling System. By manipulating the ID argument, an attacker can cause the application to execute arbitrary SQL because user-supplied input is directly incorporated into a database query. The CVE identifies this as a classic parameter injection (CWE-74) and an SQL injection (CWE-89). The description does not detail the precise consequences, but the flaw permits an attacker to inject and execute arbitrary SQL statements against the database.

SourceCodester Class and Exam Timetabling System version 1.0 is affected. No additional affected versions are enumerated in the CNA data.

The CVSS score of 6.9 denotes a medium severity risk. The EPSS score is below 1 %, indicating a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, meaning a threat actor could potentially trigger the injection from any external location without local access. Exploitation requires sending a crafted request to the edit_subject.php endpoint with a malicious ID value; the application fails to properly validate or sanitize this input prior to use in a database query.