This vulnerability affects SourceCodester Class and Exam Timetabling System 1.0. It arises from improper sanitization of the 'sy' parameter in the /archive5.php file, leading to SQL injection. An attacker can remotely exploit this flaw to inject malicious SQL commands. The CVSS 4.0 base score is 6.9 (medium severity), indicating a network attack vector with low complexity and no privileges or user interaction required. The vulnerability has been publicly disclosed, but no vendor-provided fix or mitigation is documented.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate the backend database, potentially leading to unauthorized data access or modification. The exact impact depends on the database privileges and application context. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk to affected systems.

No official patch or remediation is currently available for this vulnerability. Users of SourceCodester Class and Exam Timetabling System 1.0 should monitor the vendor's advisory channels for updates. In the meantime, restricting access to the vulnerable endpoint and employing web application firewalls with SQL injection detection rules may help mitigate risk.