Description
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This impacts the function mysqli_query of the file /admin/modal_add_coursea.php. Performing a manipulation of the argument course results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Published: 2026-09-06
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Mitigate Quickly
AI Analysis

Impact

An injected SQL statement can be executed through the course argument within the modal_add_coursea.php script of the admin interface. The flaw allows attackers to craft arbitrary SQL without input sanitation, enabling unauthorized data retrieval, modification, or deletion of the underlying database. The vulnerability is classified as SQL injection (CWE-89) and also involves improper neutralization of input (CWE-74). The description specifically states that the flaw can be exploited remotely and that public exploits exist.

Affected Systems

SourceCodester Class and Exam Timetabling System version 1.0, accessed via the /admin/modal_add_coursea.php file. No other versions or products were listed as affected.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity with a remote attack vector. EPSS is not available, but the public disclosure of exploits suggests that attackers may target the vulnerability. It is not listed in CISA KEV, but the presence of a publicly‑available exploit increases the risk of real‑world attacks. The condition requirements are minimal: remote access to the admin interface and the ability to submit a crafted course parameter.

Generated by OpenCVE AI on September 6, 2026 at 21:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑published patch or upgrade to a newer version of SourceCodester Class and Exam Timetabling System.
  • Replace the direct use of mysqli_query with prepared statements or bind parameters to eliminate the injection vector.
  • Restrict access to /admin/modal_add_coursea.php to authenticated administrators and enforce strict access controls.
  • Monitor database and web logs for suspicious query activity and anomalous administrative actions.

Generated by OpenCVE AI on September 6, 2026 at 21:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 06 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This impacts the function mysqli_query of the file /admin/modal_add_coursea.php. Performing a manipulation of the argument course results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Title SourceCodester Class and Exam Timetabling System modal_add_coursea.php mysqli_query sql injection
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Class And Exam Timetabling System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-08T13:36:46.265Z

Reserved: 2026-09-06T03:57:53.400Z

Link: CVE-2026-86223

cve-icon Vulnrichment

Updated: 2026-09-08T13:36:19.047Z

cve-icon NVD

Status : Deferred

Published: 2026-09-06T20:17:28.280

Modified: 2026-09-08T14:17:32.470

Link: CVE-2026-86223

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T22:00:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')