This vulnerability affects SourceCodester Class and Exam Timetabling System 1.0 and the file 1.php. It involves an SQL injection flaw in an unknown function of /edit_exam1.php. By manipulating the ID parameter, an attacker can inject SQL commands remotely without requiring privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). Although an exploit is publicly available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the affected system. The vulnerability does not require authentication or user interaction, increasing its risk. However, the CVSS vector indicates low confidentiality, integrity, and availability impact, suggesting limited but non-negligible consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries on the ID parameter in /edit_exam1.php to mitigate SQL injection risks. Monitoring for unusual database activity may also help detect exploitation attempts.