This vulnerability affects SourceCodester Class and Exam Timetabling System 1.0 in the /preview5.php file. An attacker can perform SQL injection by manipulating the course_year_section argument, potentially leading to unauthorized database access or modification. The attack can be executed remotely without authentication. No official patch or remediation level has been provided by the vendor as of the publication date. The exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, data modification, or other impacts depending on the database privileges. The vulnerability does not require user interaction or privileges, making it remotely exploitable. However, the CVSS vector indicates low confidentiality, integrity, and availability impacts, suggesting limited but non-negligible consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and sanitization on the course_year_section parameter to prevent SQL injection. Additionally, consider applying web application firewalls or other protective controls to detect and block SQL injection attempts.