SourceCodester Class and Exam Timetabling System 1.0 contains a SQL injection vulnerability in the /archive2.php file. The vulnerability arises from improper sanitization or validation of the 'sy' parameter, enabling an attacker to inject malicious SQL commands remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction. The vulnerability is publicly disclosed but lacks an official fix or patch as per current data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited details on the extent of database control or data exposure. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or parameterized queries on the 'sy' parameter as a temporary mitigation. Monitoring for unusual database queries related to this parameter may also help detect attempted exploitation.