This vulnerability exists in the delete_user_account.php script of SourceCodester Class and Exam Timetabling System 1.0. An attacker can manipulate the ID query parameter to inject arbitrary SQL code. The injection can alter, delete, or exfiltrate database records. The primary impact is the compromise of data integrity and confidentiality; the vulnerability can also be leveraged as a foothold for further lateral movement or data loss. It is identified as an SQL injection flaw (CWE‑89) combined with a context‑dependent injection (CWE‑74).

The affected software is SourceCodester Class and Exam Timetabling System, version 1.0, hosted on the SourceCodester platform. The flaw is located in the delete_user_account.php endpoint and affects any installation of version 1.0 that has that file present and reachable. No other versions or products are listed as impacted in the CNA data.

The CVSS score of 6.9 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered remotely by sending a crafted request to delete_user_account.php, the exploitation likelihood depends mainly on network exposure. The public disclosure of the exploit and lack of readily available countermeasures means that unpatched instances may be vulnerable. Defenders should treat this as a moderate but actionable risk.