CVE-2026-86222 in Class and Exam Timetabling System
Summary
by MITRE • 09/06/2026
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects the function mysqli_query of the file /admin/modal_add_course2.php. Such manipulation of the argument course leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/06/2026
The SourceCodester Class and Exam Timetabling System version 1.0 contains a critical security flaw within its administrative interface, specifically located in the file admin/modal_add_course2.php. This vulnerability stems from an improper handling of user-supplied input passed to the mysqli_query function through the course argument. The system fails to adequately sanitize or validate this parameter before incorporating it into dynamic SQL queries. As a result, an attacker can inject malicious SQL code directly into the database backend by manipulating the course variable during the creation or modification of course records within the administrative panel.
This flaw is classified as an SQL Injection vulnerability, which corresponds to CWE-89 in the Common Weakness Enumeration standard. The technical mechanism involves the application constructing a query string that includes unsanitized user input without employing prepared statements or proper escaping mechanisms. When the mysqli_query function executes this malformed command, the database engine interprets the injected characters as part of the SQL syntax rather than data. This allows an attacker to alter the logic of the original query, potentially bypassing authentication controls, extracting sensitive information from other tables, modifying existing records, or even executing administrative commands on the underlying database server depending on the privileges assigned to the database user account used by the application.
The operational impact of this vulnerability is severe due to its remote exploitability and public disclosure status. Since the affected function resides in an admin-facing file, it typically requires some level of authentication access; however, if administrative credentials are compromised through other means such as weak passwords or credential stuffing attacks, the attacker gains immediate ability to execute arbitrary SQL commands remotely over the network. The fact that a working exploit has been disclosed publicly significantly lowers the barrier for entry, enabling less sophisticated threat actors to leverage existing tools and techniques against unpatched instances of this software. This can lead to full database compromise, including the exposure of student records, exam schedules, personal identifiable information, and potentially system-level access if the database service runs with elevated privileges or has extensions enabled that allow file system operations.
To mitigate this risk, immediate remediation is required by developers updating the source code in admin/modal_add_course2.php. The primary fix involves refactoring the mysqli_query calls to use prepared statements with parameterized queries, which ensures that user input is treated strictly as data and never as executable SQL syntax. Additionally, implementing strict input validation on the course argument can provide a secondary layer of defense by rejecting any input containing characters commonly associated with injection attacks, such as single quotes or semicolons, unless they are part of an expected format. From a defensive operations perspective, organizations should ensure that database accounts used by web applications adhere to the principle of least privilege, restricting permissions to only those necessary for normal operation and disabling dangerous features like xp_cmdshell if applicable. Regular security audits and static code analysis tools configured with rules targeting CWE-89 can help identify similar vulnerabilities in other parts of the application before they are exploited. Monitoring database logs for anomalous query patterns consistent with SQL injection attempts, as described in MITRE ATT&CK technique T1059, is also recommended to detect potential exploitation activities in real-time.