CVE-2026-14770 in Class and Exam Timetabling System
Summary
by MITRE • 07/06/2026
A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_room.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/06/2026
This vulnerability exists within the SourceCodester Class and Exam Timetabling System version 1.0, specifically affecting the /edit_room.php file where an insecure input handling mechanism allows for sql injection attacks. The flaw occurs when an attacker manipulates the ID argument parameter, which is then directly incorporated into database queries without proper sanitization or parameterization. This type of vulnerability falls under CWE-89 which categorizes improper neutralization of special elements used in SQL commands as a code injection weakness. The attack vector is remotely exploitable, meaning an adversary can initiate the malicious payload from outside the local network without requiring physical access or privileged credentials.
The operational impact of this vulnerability is significant as it allows attackers to execute arbitrary sql commands against the underlying database system. Successful exploitation could enable unauthorized data access, modification, or deletion of critical examination room information including scheduling details, room capacities, and associated class assignments. Attackers might also leverage this vulnerability to escalate privileges within the application, potentially gaining administrative control over the entire timetabling system. The public availability of the exploit increases the risk profile substantially as it removes the requirement for advanced technical skills in developing custom attack vectors, making the system vulnerable to automated scanning and exploitation by threat actors.
Security practitioners should immediately implement multiple layers of defense to mitigate this vulnerability. Input validation and parameterized queries represent the primary mitigation strategies that must be applied to the ID argument handling within the /edit_room.php file. The application code should be reviewed to ensure all database interactions utilize prepared statements or parameterized queries rather than string concatenation approaches. Network-level protections such as web application firewalls and intrusion prevention systems can provide additional monitoring and blocking capabilities for sql injection attempts. Regular security assessments including automated scanning and manual penetration testing should be conducted to identify similar vulnerabilities throughout the application codebase. The ATT&CK framework categorizes this vulnerability under T1190 - Exploit Public-Facing Application, indicating that organizations need to maintain proper network segmentation and regularly update their applications to prevent unauthorized access through publicly exposed interfaces.