CVE-2026-86225 in Class and Exam Timetabling System
Summary
by MITRE • 09/07/2026
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqli_query of the file /admin/modal_add_room.php. The manipulation of the argument room_name leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The SourceCodester Class and Exam Timetabling System version 1.0 contains a critical security flaw within its administrative interface, specifically located in the file admin/modal_add_room.php. This vulnerability stems from an improper handling of user-supplied input when interacting with the underlying MySQL database via the PHP mysqli_query function. The specific point of failure involves the room_name argument, which is accepted as part of the process for adding new rooms to the system's schedule. Instead of properly sanitizing or parameterizing this input before its inclusion in SQL statements, the application directly incorporates it into dynamic queries. This architectural oversight creates a classic injection vector that allows malicious actors to interfere with database operations intended for legitimate administrative tasks.
This flaw is classified under CWE-89 as an Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The technical mechanism relies on the application's failure to distinguish between code and data when processing the room_name parameter. An attacker can craft a specially formatted input string containing malicious SQL syntax that alters the logic of the original query. By injecting commands such as UNION SELECT statements or conditional errors, an adversary can extract sensitive information from the database, modify existing records, or potentially execute administrative operations depending on the privileges associated with the database user account running the web application. The presence of a publicly available exploit significantly lowers the barrier to entry for attackers, enabling even those with limited technical expertise to leverage this vulnerability against unpatched instances.
The operational impact of this vulnerability is severe due to its remote exploitable nature and the context in which it occurs. Since the affected function resides within an administrative module (/admin/), successful exploitation could grant an attacker access to privileged functions that are typically restricted to authorized personnel. This can lead to a complete compromise of the system's confidentiality, integrity, and availability. Attackers may exfiltrate student data, exam schedules, user credentials, or other sensitive institutional information stored in the database. Furthermore, depending on the configuration of the MySQL server, advanced injection techniques might allow for operating system command execution, leading to full host compromise. The public availability of exploits means that automated scanning tools and opportunistic attackers are likely actively targeting systems running this specific version, increasing the probability of successful intrusion without targeted effort from adversaries.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The most effective solution is to upgrade to a patched version of the SourceCodester Class and Exam Timetabling System if one has been released by the vendor. In cases where an update is not immediately available, developers should refactor the code in admin/modal_add_room.php to utilize prepared statements with parameterized queries instead of direct string concatenation for SQL commands. This ensures that user input is treated strictly as data rather than executable code. Additionally, implementing strict input validation and sanitization routines can provide a secondary layer of defense by rejecting unexpected characters or formats before they reach the database layer. From an infrastructure perspective, deploying a Web Application Firewall with rules tuned to detect common SQL injection patterns can help block exploitation attempts in real-time while permanent fixes are implemented. Regular security audits and code reviews focusing on data access layers are essential to prevent similar vulnerabilities from being introduced into future versions of the software.