SourceCodester Class and Exam Timetabling System 1.0 contains a SQL injection vulnerability in the /edit_product.php file. The vulnerability arises from improper sanitization of the ID parameter, allowing an attacker to inject arbitrary SQL queries remotely without any privileges or user interaction. This could lead to unauthorized data access or modification. The vulnerability is publicly known and an exploit has been published, but there is no vendor-provided fix or mitigation at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may result in unauthorized data disclosure, data modification, or other impacts depending on the database privileges. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the CVSS score and vector indicate low to limited impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available for this vulnerability. Users of SourceCodester Class and Exam Timetabling System 1.0 should monitor the vendor's advisories for updates. In the meantime, applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /edit_product.php endpoint may reduce risk. Avoid exposing the vulnerable application to untrusted networks if possible.