The SourceCodester Class and Exam Timetabling System 1.0 contains a SQL injection vulnerability in the /edit_room1.php file. This vulnerability is triggered by manipulating the ID parameter, enabling an attacker to inject SQL commands remotely. The vulnerability is identified as CWE-74 (Injection). The exploit has been publicly disclosed, but no official fix or patch has been provided. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and a moderate severity rating.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability can be exploited remotely without authentication, increasing the risk of compromise. However, the severity is rated as medium/moderate.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint and monitor for suspicious activity related to SQL injection attempts.