This vulnerability affects SourceCodester Class and Exam Timetabling System 1.0. It arises from improper sanitization of the Password parameter in a function located in /index2.php, enabling remote attackers to inject SQL commands. The vulnerability allows unauthorized manipulation of the backend database via crafted input, potentially leading to data exposure or modification. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and has low to low impact on confidentiality, integrity, and availability. No official fix or vendor advisory is available at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates the impact on confidentiality, integrity, and availability is low, and no privilege or user interaction is required. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewalls or input validation controls to mitigate SQL injection risks. Monitor for updates from the vendor or trusted security sources regarding patches or official mitigations.