CVE-2026-86208 in Class and Exam Timetabling System
Summary
by MITRE • 09/06/2026
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /delete_teacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/06/2026
The SourceCodester Class and Exam Timetabling System version 1.0 contains a critical security vulnerability within its administrative module, specifically affecting the /delete_teacher.php endpoint. This flaw represents an SQL injection weakness that arises from insufficient input validation and sanitization of user-supplied data. The application fails to properly escape special characters or utilize parameterized queries when processing the ID argument passed via HTTP requests. Consequently, an attacker can inject malicious SQL code into this parameter, which is then executed directly by the underlying database management system without adequate safeguards. This type of vulnerability falls under CWE-89, commonly known as Improper Neutralization of Special Elements used in an SQL Command, and it allows for unauthorized manipulation of backend data structures.
The operational impact of this vulnerability is severe due to its remote exploitable nature. An attacker does not require authentication or physical access to the network infrastructure to launch attacks against the system. By crafting specific HTTP requests with malicious payloads embedded in the ID parameter, a threat actor can interact directly with the database engine. This capability enables a range of destructive actions including but not limited to extracting sensitive information such as user credentials and personal data stored within the timetabling records, modifying or deleting critical educational scheduling data, and potentially escalating privileges to gain full control over the underlying server if the database service runs with elevated permissions. The availability of public exploit code significantly lowers the barrier for entry, allowing less sophisticated attackers to compromise systems running this specific version of the software.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter through SQL commands, as well as T1114 Email Collection if email data is exfiltrated, though primarily it facilitates Data Exfiltration via T1005. The presence of public exploits indicates that automated scanning tools are likely already targeting instances of this software on the internet. Organizations relying on this legacy system face immediate risk of data breach and service disruption. The lack of input validation suggests a fundamental flaw in the application development lifecycle, where security testing was either absent or ineffective during the deployment phase.
Mitigation strategies must be implemented immediately to address these risks. The most effective long-term solution is to upgrade to a patched version of the SourceCodester Class and Exam Timetabling System if one has been released by the vendor. In cases where an update is unavailable, immediate remediation involves modifying the /delete_teacher.php script to implement strict input validation that rejects any non-integer values for the ID parameter. Furthermore, developers should refactor the database interaction code to use prepared statements with parameterized queries, which inherently prevent SQL injection by separating code from data. Web Application Firewalls can also be configured to detect and block common SQL injection patterns targeting this specific endpoint as a temporary compensating control while permanent fixes are deployed. Regular security audits and penetration testing of all web-facing applications are essential to identify similar vulnerabilities before they can be exploited in the wild.