PT-2026-86572 · Sourcecodester · Class/Exam Timetabling System
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
SourceCodester Class and Exam Timetabling System version 1.0
Description
Remote SQL injection is possible through the manipulation of the
room name variable within the mysqli query() function located in the /admin/modal add room.php file. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to interfere with the database.Recommendations
Update SourceCodester Class and Exam Timetabling System version 1.0 to a version that contains a fix for this issue.
As a temporary mitigation, restrict access to the
/admin/modal add room.php file or avoid using the room name parameter until a patch is applied.Exploit
Fix
Special Elements Injection
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Class/Exam Timetabling System