Description
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit_subject1.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-08-17
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability involves unchecked manipulation of the ID argument in /edit_subject1.php, allowing an attacker to inject arbitrary SQL commands via a web request. This flaw, captured by CWE-89 and CWE-74, could enable unauthorized data disclosure, modification, or deletion, threatening the confidentiality and integrity of the application’s database. The impact is significant because an attacker can gain full control over the database content if the database user has sufficient privileges.

Affected Systems

The security weakness affects SourceCodester Class and Exam Timetabling System version 1.0, specifically the /edit_subject1.php script integrated into the application under the Product Name 'SourceCodester:Class and Exam Timetabling System'. No additional versions or components are listed, limiting the scope to this particular release.

Risk and Exploitability

With a CVSS score of 6.9, the vulnerability is rated medium but remote exploitation is possible through a web browser or automated tool that crafts malicious ID values. EPSS data is unavailable, and the issue is not listed in CISA KEV, so widespread exploitation is presently unknown, yet public disclosures confirm that the exploit has been exposed and could be employed without additional conditions.

Generated by OpenCVE AI on August 18, 2026 at 00:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the SourceCodester Class and Exam Timetabling System to a patched version or newer release that addresses the SQL injection in edit_subject1.php.
  • If an update is not immediately available, restrict access to edit_subject1.php by configuring the web server or firewall to allow only authenticated users or specific IP ranges, and deploy a Web Application Firewall to filter and block suspicious SQL payloads.
  • Review the code handling the ID parameter to ensure it uses parameterized queries or at least sanitizes and validates that the ID is numeric before inclusion in the SQL statement, thus closing the injection window.

Generated by OpenCVE AI on August 18, 2026 at 00:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit_subject1.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Title SourceCodester Class and Exam Timetabling System edit_subject1.php sql injection
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Class And Exam Timetabling System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-17T23:30:09.339Z

Reserved: 2026-08-17T16:11:08.708Z

Link: CVE-2026-75080

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-18T00:16:53.543

Modified: 2026-08-18T00:16:53.543

Link: CVE-2026-75080

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T00:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')