CVE-2026-86220 in Class and Exam Timetabling System
Summary
by MITRE • 09/06/2026
A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The affected element is the function mysqli_query of the file /admin/modal_add_course.php. The manipulation of the argument course results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/06/2026
The SourceCodester Class and Exam Timetabling System version 1.0 contains a critical security flaw within its administrative interface, specifically located in the file /admin/modal_add_course.php. This vulnerability stems from an improper handling of user-supplied input passed to the mysqli_query function through the course argument parameter. The application fails to adequately sanitize or validate this input before incorporating it into SQL commands executed against the backend database. As a result, an attacker can inject arbitrary SQL code that is interpreted by the database engine rather than being treated as literal data. This specific type of flaw is classified under CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The presence of this vulnerability allows for a significant breach of data integrity and confidentiality within the system's administrative scope.
The operational impact of this vulnerability is severe due to its remote exploitability. An attacker does not need physical access or prior authentication credentials if they can interact with the specific endpoint associated with adding courses, although in many implementations such admin functions may require some level of initial session validation which could be bypassed through other means like session hijacking or credential stuffing attacks combined with this injection capability. Once exploited, the vulnerability enables a wide range of malicious activities including unauthorized data extraction from sensitive tables containing student records, exam schedules, and user credentials. It also permits modification or deletion of existing database entries, potentially disrupting academic operations by altering timetables or removing critical course information. In more advanced scenarios, if the underlying database service runs with elevated privileges such as root access on a Unix-like system, an attacker might leverage this SQL injection to execute operating system commands via specific database features like LOAD_FILE or INTO OUTFILE, thereby achieving full remote code execution and complete compromise of the hosting server infrastructure.
This vulnerability aligns closely with several techniques documented in the MITRE ATT&CK framework. The initial exploitation phase corresponds to T1190 Exploit Public-Facing Application, as attackers target a known public-facing web application flaw. If data is exfiltrated through error-based or blind SQL injection techniques, it falls under T1005 Data from Local System combined with T1074 Data Staged if the attacker organizes stolen information before exfiltration. Furthermore, if the attack leads to privilege escalation within the database layer, it may relate to T1068 Exploitation for Privilege Escalation depending on how the compromised account is utilized subsequently. The fact that a public exploit exists significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and opportunistic attacks targeting this specific software version across various deployments worldwide.
Mitigation strategies must be implemented immediately to address this critical risk. The primary technical fix involves refactoring the affected code in /admin/modal_add_course.php to use prepared statements with parameterized queries instead of direct string concatenation within mysqli_query calls. This approach ensures that user input is treated strictly as data and never as executable SQL syntax, effectively neutralizing injection attempts regardless of the content provided by the attacker. Additionally, developers should implement strict input validation on all parameters received from HTTP requests, enforcing expected formats such as alphanumeric characters for course identifiers where applicable. Beyond code changes, defense-in-depth measures are recommended including deploying a Web Application Firewall to filter malicious payloads at the network perimeter and ensuring that database accounts used by the application adhere to the principle of least privilege, restricting permissions to only those necessary for normal operation rather than granting broad administrative rights within the database engine. Regular security audits and static code analysis tools should also be integrated into the development lifecycle to detect similar patterns in other parts of the system before deployment.