This vulnerability affects SourceCodester Class and Exam Timetabling System 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the 'sy' parameter in the /archive5.php script. The vulnerability allows unauthorized SQL commands to be injected, potentially impacting the confidentiality and integrity of the backend database. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No official fix or patch has been disclosed, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated as medium severity with limited confidentiality, integrity, and availability impact. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should consider applying temporary mitigations such as input validation and parameterized queries if possible. Monitoring for unusual database activity may help detect exploitation attempts. Avoid exposing the vulnerable endpoint to untrusted networks until a patch is released.