SourceCodester Class and Exam Timetabling System 1.0 contains a SQL injection vulnerability in an unspecified function within /edit_product.php. The vulnerability arises from improper sanitization of the ID parameter, allowing remote attackers to inject SQL commands. This can lead to unauthorized data access or manipulation. The vulnerability is remotely exploitable without privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. No vendor remediation or patch is currently documented.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized disclosure, modification, or deletion of data within the affected system. The impact is rated medium severity based on the CVSS 6.9 score. There are no confirmed reports of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. Users of SourceCodester Class and Exam Timetabling System 1.0 should monitor vendor advisories for updates. In the meantime, restricting access to the affected endpoint and employing web application firewalls with SQL injection detection rules may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.