This vulnerability in SourceCodester Class and Exam Timetabling System 1.0 and 1.php allows an attacker to perform SQL injection via the ID parameter in /edit_room1.php. The injection flaw enables unauthorized manipulation of backend database queries. The vulnerability is remotely exploitable without privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to manipulate SQL queries on the affected system, potentially leading to unauthorized data access or modification. The vulnerability affects confidentiality, integrity, and availability at a low level according to the CVSS vector. However, the exact impact depends on the backend database and application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and validate or sanitize input parameters to mitigate injection risk.