The vulnerability is a SQL injection caused by insufficient validation of the ID parameter in edit_subject2.php. The flaw permits an attacker to inject arbitrary SQL statements, potentially exposing or modifying database contents. The affected code runs when the ID argument is manipulated. The vulnerability is linked to CWE-74 and CWE-89. An attacker controlling the ID can read, alter, or delete data, affecting confidentiality and integrity.

This issue affects SourceCodester's Class and Exam Timetabling System version 1.0. The product is available under the SourceCodester vendor portal and is distributed as open source. No other versions are listed as affected. The vulnerable file resides in the application's core codebase; it is publicly accessible through the web interface.

The CVSS score of 6.9 indicates moderate severity, and the publicly available exploit means the risk is elevated. Although the EPSS score is not provided and the flaw is not in KEV, based on the description it is inferred that the vulnerability may be exploitable without requiring authentication, but this is not explicitly confirmed. Mitigation requires patching or secure coding practices. The lack of a vendor workaround means administrators must take immediate action.