This vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to conduct SQL injection attacks by manipulating the ID parameter in the /edit_rooma.php script. The injection flaw could lead to unauthorized database queries or data exposure. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. No official fix or patch has been published as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impact according to the CVSS vector. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected functionality, applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter, and reviewing application input validation controls to mitigate risk.