This vulnerability affects SourceCodester Class and Exam Timetabling System 1.0. An attacker can exploit improper input handling of the Password parameter in /index2.php to perform SQL injection attacks remotely. The vulnerability allows unauthorized database queries with limited confidentiality, integrity, and availability impact. Although an exploit is publicly known, there is no vendor-provided fix or mitigation at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability consequences as indicated by the CVSS vector. No evidence of active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewalls or input validation controls to mitigate SQL injection risks. Monitor vendor channels for updates and apply patches promptly once available.