This vulnerability involves an SQL injection in the SourceCodester Class and Exam Timetabling System 1.0, specifically in the /archive3.php file. The injection occurs via the 'sy' parameter, which is not properly sanitized, enabling attackers to inject malicious SQL commands remotely. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known but no official fix or patch has been released as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or other database-related impacts. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. However, the overall impact is rated medium due to limited details on the extent of data exposure or system control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor for vendor updates. As a temporary measure, restricting access to the vulnerable endpoint or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'sy' parameter may help reduce risk.