This vulnerability involves an SQL injection flaw in SourceCodester Class and Exam Timetabling System 1.0. Specifically, the argument course_year_section in the /preview4.php file is not properly sanitized, enabling an attacker to inject malicious SQL queries. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. No vendor remediation or patch has been published as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or web application firewall (WAF) rules to block malicious payloads targeting the course_year_section parameter. Monitor for vendor updates regarding patches or official mitigations.