Description
A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The affected element is the function mysqli_query of the file /admin/modal_add_course.php. The manipulation of the argument course results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
Published: 2026-09-06
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the modal_add_course.php script of SourceCodester's Class and Exam Timetabling System, where the course argument is passed directly to mysqli_query without proper sanitization. This flaw permits an attacker to inject arbitrary SQL statements, potentially retrieving sensitive data, modifying records, or deleting data. The flaw is categorized as a classic SQL injection (CWE-74 and CWE-89) and is exploitable in a remote context as the vulnerable script is accessible via the web interface.

Affected Systems

SourceCodester’s Class and Exam Timetabling System version 1.0 is affected. Users running that specific version on any PHP-enabled web server that hosts the application are vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. Exploit code is publicly available and can be launched remotely, but the EPSS score is not provided, so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, yet the public nature of the exploit makes it a real threat.

Generated by OpenCVE AI on September 6, 2026 at 18:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a vendor patch that replaces raw mysqli_query calls with parameterized queries or stored procedures
  • Validate and sanitize the course input to accept only expected and safe values
  • If a patch is unavailable, restrict remote access to the administration panel via network or VPN and monitor for suspicious activity

Generated by OpenCVE AI on September 6, 2026 at 18:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The affected element is the function mysqli_query of the file /admin/modal_add_course.php. The manipulation of the argument course results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
Title SourceCodester Class and Exam Timetabling System modal_add_course.php mysqli_query sql injection
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Class And Exam Timetabling System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-06T17:15:10.119Z

Reserved: 2026-09-06T03:57:42.314Z

Link: CVE-2026-86220

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-06T18:17:23.150

Modified: 2026-09-06T18:17:23.150

Link: CVE-2026-86220

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T18:30:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')