The vulnerability CVE-2026-13488 affects SourceCodester Class and Exam Timetabling System 1.0 and the 7.php file. It is caused by improper sanitization of the course_year_section parameter in the /preview7.php script, enabling remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the exploit code has been publicly released.

Successful exploitation of this SQL injection vulnerability could allow remote attackers to execute arbitrary SQL queries on the backend database. This may lead to unauthorized data access, modification, or deletion depending on the database privileges. The impact is limited but significant enough to warrant attention due to the potential for data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection via the course_year_section parameter.