The vulnerability occurs in SourceCodester Class and Exam Timetabling System 1.0 where the "course" parameter passed to mysqli_query in admin/modal_add_course1.php is not sanitized. This allows an attacker to inject arbitrary SQL statements, giving the ability to read, modify or delete data from the underlying database. The flaw is rooted in improper input handling (CWE-74) and the lack of parameterization (CWE-89), potentially compromising confidentiality, integrity, and availability of the scheduling data.

SourceCodester offers the Class and Exam Timetabling System version 1.0. The flaw resides in the admin component used for adding courses via the modal interface. No other product or version details are provided by the CNA.

The CVSS score of 6.9 indicates a moderate severity. The description states that the attack may be initiated remotely, and the exploit has been published. Because the application is a web-based scheduling system accessed via HTTP/HTTPS, the likely attack vector is through crafted HTTP requests to the admin/modal_add_course1.php endpoint. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. If exploited, an attacker could gain unauthorized database access, potentially exfiltrating sensitive scheduling information or modifying exam records.