Llfak

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** An issue exists in the `/preview.php` endpoint where manipulating the `course year section` variable allows for SQL injection. This allows a remote attacker to interfere with the database queries. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to data. **Recommendations** Update SourceCodester Class and Exam Timetabling System version 1.0. As a temporary workaround, restrict access to the `/preview.php` file or avoid using the `course year section` parameter until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** An SQL injection issue exists in the `/preview6.php` endpoint. A remote attacker can exploit this by manipulating the `course year section` variable, allowing for the execution of unauthorized database queries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** An issue exists in the `/archive.php` file where the manipulation of the `sy` argument allows for SQL injection. This allows a remote attacker to interfere with the database queries. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to data. **Recommendations** As a temporary workaround, restrict access to the `/archive.php` file or avoid using the `sy` argument until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.