CVE-2026-86221 in Class and Exam Timetabling System
Summary
by MITRE • 09/06/2026
A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli_query of the file /admin/modal_add_course1.php. This manipulation of the argument course causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/06/2026
The SourceCodester Class and Exam Timetabling System version 1.0 contains a critical security vulnerability that allows for remote code execution through database interaction flaws. Specifically, the issue resides within the administrative module located at /admin/modal_add_course1.php, where the application fails to properly sanitize user-supplied input before incorporating it into SQL queries. This lack of validation directly impacts the mysqli_query function, which is responsible for executing commands against the backend MySQL database server. The vulnerability arises because the course argument passed by the attacker is not filtered or parameterized, allowing malicious SQL syntax to be injected alongside legitimate query structures.
This flaw represents a classic instance of an injection attack where untrusted data interferes with the intended execution of a command or query. In this specific context, the manipulation of the course variable enables an adversary to alter the logic of the database statement. By injecting carefully crafted payloads, an attacker can bypass authentication mechanisms, extract sensitive information from other tables within the same database schema, modify existing records, or even execute administrative operations on the underlying operating system if the database service has elevated privileges. The presence of a published exploit indicates that this vulnerability is well-understood and easily leveraged by automated scanning tools or malicious actors seeking to compromise systems running this specific version of the software.
From an operational perspective, the impact of this vulnerability extends beyond simple data theft. Since the affected file resides in the admin directory, successful exploitation likely requires some level of access or interaction with administrative interfaces, although certain configurations might allow unauthenticated users to trigger the modal if session management is weakly implemented. If exploited effectively, attackers can gain full control over the application's database content, leading to data integrity loss, confidentiality breaches involving student and instructor records, and potential defacement of the system interface. The remote nature of this attack vector means that no physical proximity or local access is required, significantly increasing the risk profile for any organization deploying this untimed software in a production environment.
Industry standards classify this type of vulnerability under CWE-89, which denotes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. Furthermore, within the MITRE ATT&CK framework, this activity aligns with techniques related to Data from Information Repositories and potentially Taint Analysis if the injection leads to further lateral movement or privilege escalation. The failure to use prepared statements or parameterized queries is a fundamental deviation from secure coding practices recommended by OWASP for preventing such injections.
Mitigation strategies must focus on immediate remediation of the source code and broader security hardening measures. Developers should refactor the modal_add_course1.php file to utilize PDO (PHP Data Objects) with prepared statements, ensuring that all user inputs are treated as data rather than executable code. Input validation should be implemented at both the client and server sides to reject unexpected characters or formats in the course field. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by filtering malicious SQL patterns before they reach the application logic. Organizations currently running this version must prioritize patching or upgrading to a secure alternative immediately to prevent exploitation given the availability of public exploits.