CVE-2026-14772 in Class and Exam Timetabling System
Summary
by MITRE • 07/06/2026
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The impacted element is an unknown function of the file /edit_course1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/08/2026
The vulnerability identified in SourceCodester Class and Exam Timetabling System version 1.0 presents a critical sql injection flaw within the /edit_course1.php file that compromises the system's database integrity and confidentiality. This vulnerability exists due to improper input validation and sanitization of user-supplied data, specifically the ID argument parameter that is directly incorporated into sql query constructions without adequate escaping or parameterization mechanisms. The attack vector is remotely exploitable, meaning malicious actors can leverage this weakness from external network positions without requiring physical access to the system infrastructure.
The technical implementation of this vulnerability stems from the application's failure to properly handle user input within the edit_course1.php script where the ID parameter is processed through an unknown function that does not employ secure database query construction practices. This allows attackers to inject malicious sql code through the ID argument, potentially enabling unauthorized data access, modification, or deletion operations against the underlying database system. The vulnerability's classification aligns with common weakness enumeration CWE-89 which specifically addresses sql injection flaws in software applications. The remote exploitability factor indicates that this vulnerability can be triggered through web-based interfaces without requiring local system access, making it particularly dangerous for internet-facing applications.
The operational impact of this vulnerability extends beyond simple data compromise to potentially enable complete system takeover and unauthorized administrative access. Attackers could leverage the sql injection to extract sensitive user credentials, student information, academic records, and other confidential data stored within the timetable management system. The disclosed exploit status significantly increases the risk level as malicious actors can immediately implement attacks without requiring additional reconnaissance or development efforts. This vulnerability directly violates industry security standards and best practices outlined in frameworks such as the OWASP Top Ten, specifically addressing the sql injection category that consistently ranks among the most critical web application security risks.
Mitigation strategies for this vulnerability should prioritize immediate implementation of parameterized queries and prepared statements to eliminate direct sql injection possibilities through user input manipulation. The application code must undergo comprehensive input validation and sanitization processes where all external data is treated as untrusted and properly escaped before database integration. Network-level protections including web application firewalls and intrusion detection systems should be deployed to monitor for malicious sql injection patterns and block suspicious traffic attempts. Additionally, regular security audits and penetration testing should be conducted to identify similar vulnerabilities within the application codebase, while access controls and least privilege principles should be enforced to limit potential damage from successful exploitation attempts. The system administrators must also consider implementing database activity monitoring and logging mechanisms to detect unauthorized access patterns that may indicate exploitation attempts against this vulnerability.