This vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within an unspecified function in /preview.php. By manipulating the course_year_section parameter, an attacker can inject SQL commands remotely, potentially compromising the database. The CVSS 4.0 base score is 6.9 (medium severity), indicating a network attack vector with low complexity and no privileges or user interaction required. The vulnerability has been publicly disclosed, but no vendor remediation or patch is currently documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, the CVSS vector indicates limited confidentiality, integrity, and availability impact (low to limited).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewalls or input validation controls to mitigate SQL injection risks. Monitor for updates from SourceCodester regarding patches or official mitigations.