A SQL injection flaw exists in the /admin/modal_add_product.php file of the SourceCodester Class and Exam Timetabling System 1.0. The issue is tied to the mysqli_query call that processes the fname parameter without proper sanitization, allowing an attacker to inject arbitrary SQL statements. Successful exploitation can let the attacker read sensitive data, modify or delete database content, and potentially compromise the integrity and confidentiality of the system’s information. The weakness aligns with CWE-89, indicative of an injection vulnerability.

The vulnerability affects sourcecodester:Class and Exam Timetabling System version 1.0. No other vendors or products are listed as impacted.

The CVSS score of 6.9 places the issue in the moderate‑to‑high severity range. Although EPSS data is not provided, the vulnerability has a publicly disclosed exploit and can be triggered remotely, implying a realistic risk to any exposed instance of the application. Since the system is an administrative module, making it directly reachable could allow both authenticated and unauthenticated attackers to leverage the flaw. The lack of a KEV listing does not diminish its potential impact because the exploit mechanics are straightforward: construct a malicious fname value and submit it via the vulnerable endpoint.