Description
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /delete_subject.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-09-07
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL injection
Action: Immediate Patch
AI Analysis

Impact

The identified vulnerability is a classic SQL injection located in the delete_subject.php endpoint of the 1.0 release of SourceCodester Class and Exam Timetabling System. An attacker can tamper with the ID field, causing the application to execute arbitrary SQL statements. The CVE report explicitly states remote exploitation is possible. While the flaw does not grant remote code execution, it can expose, modify or delete data, compromising confidentiality, integrity and availability of the underlying database. The weakness corresponds to CWE-74 and CWE-89.

Affected Systems

SourceCodester Class and Exam Timetabling System version 1.0 is affected. No additional versions or sub‑products are mentioned. Environments running a later release (if available) are not indicated as impacted.

Risk and Exploitability

The CVSS score of 6.9 signals moderate severity. EPSS data is not available, but the publicly disclosed exploit implies that a motivated attacker could readily leverage the flaw. The flaw can be triggered remotely via a crafted HTTP request to delete_subject.php and lacks any requirement for privileged or authenticated users, making it a high‑impact risk for anyone who can reach the exposed URL.

Generated by OpenCVE AI on September 7, 2026 at 13:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade to the latest release that includes input validation for the ID parameter.
  • If no patch is available, modify the application to accept only numeric values for the ID using strict type checking or prepared statements, thereby preventing injection.
  • Deploy a web application firewall rule or configure ModSecurity to detect and block SQL injection patterns targeting delete_subject.php.

Generated by OpenCVE AI on September 7, 2026 at 13:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /delete_subject.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Title SourceCodester Class and Exam Timetabling System delete_subject.php sql injection
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Class And Exam Timetabling System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-08T13:39:33.533Z

Reserved: 2026-09-06T16:26:05.250Z

Link: CVE-2026-86298

cve-icon Vulnrichment

Updated: 2026-09-08T13:39:29.942Z

cve-icon NVD

Status : Deferred

Published: 2026-09-07T11:17:39.917

Modified: 2026-09-08T14:17:34.153

Link: CVE-2026-86298

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T14:30:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')