A flaw in the modal_add_room.php function allows an attacker to manipulate the room_name argument and inject arbitrary SQL statements via the mysqli_query call. This creates a remote SQL injection vulnerability that can compromise the integrity and confidentiality of the underlying database, potentially permitting unauthorized data disclosure, modification, or even deletion. The weakness is identified as a classic SQL injection (CWE-89) with input handling issues (CWE-74).

The vulnerability affects SourceCodester Class and Exam Timetabling System version 1.0, specifically the /admin/modal_add_room.php module used for adding rooms. This module is accessible through the system’s administrative interface.

With a CVSS score of 6.9, the vulnerability is considered high severity. Although its EPSS score is not provided, the description states that public exploits are available, indicating a non‑negligible likelihood of exploitation. The attack is possible to be carried out remotely via crafted HTTP requests targeting the room_name parameter. Because the vulnerability pertains to an administrative function, the impact can be significant even if authentication is required. The vulnerability is not currently listed in CISA’s KEV catalog.