This vulnerability affects SourceCodester Class and Exam Timetabling System 1.0, specifically an unknown function in /index1.php. By manipulating the Password parameter, an attacker can inject SQL commands, potentially compromising the underlying database. The attack vector is remote and requires no privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, and no privileges required.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited complexity and partial impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected system and monitor for unusual activity related to the Password parameter. Avoid exposing the vulnerable endpoint to untrusted networks if possible.