Wuyan-Set

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** An issue exists in the `/preview7.php` endpoint where the `course year section` argument is susceptible to SQL injection, a technique that allows an attacker to interfere with the queries that an application makes to its database. This flaw can be exploited remotely. **Recommendations** Update SourceCodester Class and Exam Timetabling System version 1.0 to a version that contains a fix for this issue. As a temporary mitigation, restrict access to the `/preview7.php` endpoint or avoid using the `course year section` parameter until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Hospitals Patient Records Management System version 1.0 **Description** A remote SQL injection flaw exists in the file '/classes/Master.php?f=save patient history'. The issue occurs due to improper manipulation of the `ID` argument, allowing an attacker to execute arbitrary SQL commands. **Recommendations** As a temporary workaround, restrict access to the '/classes/Master.php?f=save patient history' endpoint or avoid using the `ID` parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Hospitals Patient Records Management System version 1.0 **Description** A remote SQL injection exists in the file '/admin/patients/manage history.php'. The issue occurs due to improper manipulation of the `ID` argument, allowing an attacker to execute arbitrary SQL commands. **Recommendations** As a temporary workaround, restrict access to the '/admin/patients/manage history.php' file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.