CVE-2026-86209

SourceCodester Class and Exam Timetabling System delete_user.php sql injection

View on CVE.org
Published Sep 6, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_user.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Analysis

AI-generated

Technical impact

The vulnerability resides in the delete_user.php script of the SourceCodester Class and Exam Timetabling System. Manipulating the ID argument allows an attacker to inject arbitrary SQL statements, potentially causing unauthorized data disclosure, modification, or deletion. This is a classical SQL injection (CWE‑89). Publicly available exploits are known, and the attack can be launched remotely via the web interface.

Affected Systems

SourceCodester Class and Exam Timetabling System version 1.0, sold by SourceCodester. The flaw affects unknown function in delete_user.php that processes user-supplied IDs.

Risk and Exploitability

The CVSS score is 6.9, indicating a moderate severity. EPSS data is unavailable, so the exploitation probability cannot be precisely quantified, but the public release of exploits and the remote nature of the attack suggest significant risk. The vulnerability is not listed in the CISA KEV catalog, yet the lack of authentication checks may allow attackers without credentials to exploit it.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s security patch or upgrade to a newer release that addresses the delete_user.php injection flaw (consult sourcecodester.com for updates).
  • Refactor the affected code to use parameterized queries or prepared statements for all database interactions, eliminating reliance on user‑supplied values in SQL statements.
  • Configure the web application’s database user with the least privileges required, and enable detailed logging to detect abnormal query patterns that could indicate exploitation attempts.

Generated by OpenCVE AI on September 6, 2026 at 10:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_user.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Title SourceCodester Class and Exam Timetabling System delete_user.php sql injection
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 8, 2026, 3:18 PM
Reserved
Sep 5, 2026, 2:07 PM

View source JSON

Updated
Sep 8, 2026, 3:18 PM

JSON

Status
Deferred
Published
Sep 6, 2026, 10:17 AM
Modified
Sep 8, 2026, 4:18 PM

View source JSON

No data.

Updated
Sep 6, 2026, 10:30 AM

JSON