A SQL injection flaw exists in the edit_teacher.php file of SourceCodester Class and Exam Timetabling System 1.0. By manipulating the ID argument, an attacker can launch a query injection that may read or alter database contents. The vulnerability is classified as CWE‑74 and CWE‑89. If exploited, the attacker could exfiltrate sensitive staff or exam data, alter teacher records, or potentially pivot to higher privilege operations, thereby compromising confidentiality and integrity of the system.

The affected product is SourceCodester Class and Exam Timetabling System version 1.0. No other versions or variants were specified in the vendor or CPE data.

The CVSS score of 6.9 indicates a moderately high risk, but the EPSS score is not available, preventing a precise probability estimate. The vulnerability is not listed in the CISA KEV catalog. The attack can be performed from a remote location by supplying a crafted ID value to the edit_teacher.php endpoint. Given the lack of authentication requirements mentioned, it is inferred that the endpoint is publicly accessible, increasing the likelihood that the flaw can be exploited by unauthenticated actors.