The vulnerability resides in the delete_user.php script of the SourceCodester Class and Exam Timetabling System. Manipulating the ID argument allows an attacker to inject arbitrary SQL statements, potentially causing unauthorized data disclosure, modification, or deletion. This is a classical SQL injection (CWE‑89). Publicly available exploits are known, and the attack can be launched remotely via the web interface.

SourceCodester Class and Exam Timetabling System version 1.0, sold by SourceCodester. The flaw affects unknown function in delete_user.php that processes user-supplied IDs.

The CVSS score is 6.9, indicating a moderate severity. EPSS data is unavailable, so the exploitation probability cannot be precisely quantified, but the public release of exploits and the remote nature of the attack suggest significant risk. The vulnerability is not listed in the CISA KEV catalog, yet the lack of authentication checks may allow attackers without credentials to exploit it.