This vulnerability affects SourceCodester Class and Exam Timetabling System 1.0. An attacker can remotely exploit a SQL injection flaw by manipulating the ID argument in the /edit_room.php script. This allows unauthorized SQL commands to be executed on the backend database, potentially leading to data leakage or modification. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official remediation or patch has been disclosed by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the database used by the Class and Exam Timetabling System. This may lead to unauthorized access to sensitive data, data modification, or disruption of service. The impact is limited to the confidentiality, integrity, and availability of the affected system's database. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /edit_room.php endpoint. Review and sanitize all user inputs, especially the ID parameter, to mitigate exploitation risk.