CVE-2026-86224 in Class and Exam Timetabling System
Summary
by MITRE • 09/06/2026
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_product.php. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The SourceCodester Class and Exam Timetabling System version 1.0 contains a critical security flaw within its administrative interface, specifically located in the file /admin/modal_add_product.php. This vulnerability stems from improper input validation and sanitization practices when handling user-supplied data passed to the PHP mysqli_query function. The specific parameter fname is processed without adequate filtering before being incorporated into an SQL query string. This architectural oversight allows an attacker to inject malicious SQL commands directly into the database backend, bypassing intended application logic controls.
This flaw constitutes a classic example of SQL Injection, categorized under CWE-89 in the Common Weakness Enumeration standard. The vulnerability arises because the application fails to distinguish between code and data when constructing queries against the MySQL server. By manipulating the fname argument, an attacker can alter the structure of the executed SQL statement. This capability enables unauthorized access to sensitive database records, modification or deletion of critical system data, and potentially full compromise of the underlying database management system depending on the privileges assigned to the application's database user account.
The operational impact of this vulnerability is severe due to its remote exploitability. An attacker does not require prior authentication or physical proximity to execute the attack vector over a network connection. Since the affected function resides in an administrative module, successful exploitation could lead to complete compromise of the system's integrity and confidentiality. The public disclosure of exploits for this specific version means that automated scanning tools and malicious actors can readily identify vulnerable instances on the internet. This significantly increases the risk profile, as defenders must assume active targeting attempts against any deployed instance running this unpatched software.
Mitigation strategies should prioritize immediate remediation through code modification or system replacement. The most effective technical fix involves replacing direct string concatenation in SQL queries with prepared statements using parameterized queries provided by the mysqli extension. This ensures that user input is treated strictly as data rather than executable code, neutralizing injection attempts regardless of content. Additionally, implementing strict input validation on all entry points, particularly for administrative functions, adds a layer of defense-in-depth. Given the public availability of exploits and the critical nature of database integrity in educational timetabling systems, upgrading to a patched version or migrating to a supported alternative with robust security practices is strongly recommended to eliminate this attack surface entirely.