This vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows an unauthenticated remote attacker to perform SQL injection by manipulating the course_year_section parameter in the /preview.php script. The vulnerability is confirmed by CVE-2026-13485 with a CVSS 4.0 base score of 6.9 (medium severity). The exploit has been publicly disclosed, increasing the risk of exploitation. No vendor advisory or patch information is provided, and the remediation level is unknown.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database with limited confidentiality, integrity, and availability impact as indicated by the CVSS vector. This may lead to unauthorized data access or modification within the affected system. The vulnerability is exploitable remotely without authentication, increasing exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected endpoint and validating or sanitizing inputs at the application or web server level to mitigate injection risks.