CVE-2026-86223 in Class and Exam Timetabling System
Summary
by MITRE • 09/06/2026
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This impacts the function mysqli_query of the file /admin/modal_add_coursea.php. Performing a manipulation of the argument course results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/06/2026
The SourceCodester Class and Exam Timetabling System version 1.0 contains a critical security flaw within its administrative interface, specifically located in the file /admin/modal_add_coursea.php. This vulnerability manifests as an SQL injection weakness affecting the mysqli_query function, which is responsible for executing database operations based on user-supplied input. The root cause of this issue lies in the insufficient sanitization and validation of the course argument passed to the query execution mechanism. Because the application fails to properly escape special characters or utilize parameterized queries when processing this specific input field, an attacker can inject arbitrary SQL commands into the backend database structure. This represents a classic instance of improper neutralization of special elements used in an SQL command, commonly categorized under CWE-89 within industry-standard vulnerability classification systems.
The operational impact of this flaw is severe due to its remote exploitable nature and public availability. Since the affected function resides within the admin module, it implies that authentication may be required to trigger the initial request; however, if administrative credentials are compromised or if there exists a path for unauthenticated access through other means, the risk escalates significantly. An attacker can leverage this vulnerability to manipulate database queries, potentially leading to unauthorized data disclosure, modification of critical timetabling records, or even complete compromise of the underlying database server depending on its configuration and privileges. The existence of public exploits further lowers the barrier for entry, allowing less sophisticated threat actors to execute attacks against systems running this specific version without needing to develop custom tooling. This aligns with ATT&CK techniques related to SQL injection-based data exfiltration or manipulation, highlighting the direct threat to data integrity and confidentiality.
Mitigation strategies must focus on immediate remediation of the codebase alongside broader security hardening measures. The primary fix involves refactoring the mysqli_query calls in modal_add_coursea.php to use prepared statements with bound parameters instead of directly interpolating user input into SQL strings. This ensures that any special characters within the course argument are treated as literal data rather than executable code. Additionally, implementing strict input validation on all administrative endpoints can provide a secondary layer of defense by rejecting unexpected or malformed inputs before they reach the database layer. Organizations should also enforce principle of least privilege for database accounts used by the application to limit the potential damage if an injection is successful. Regular security audits and static analysis tools should be employed to detect similar patterns across other parts of the system, ensuring that no other endpoints suffer from analogous weaknesses due to inconsistent coding practices.