This vulnerability in SourceCodester Class and Exam Timetabling System 1.0 involves SQL injection via the ID parameter in the /edit_subject1.php script. Attackers can remotely manipulate this parameter to execute unauthorized SQL commands against the backend database. The vulnerability is identified as CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The CVSS 3.1 base score is 6.9, reflecting network attack vector, low complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no vendor patch or fix is currently documented.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score and the nature of SQL injection vulnerabilities. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection attacks. Monitor vendor channels for updates and apply official patches once released.