This vulnerability in SourceCodester Class and Exam Timetabling System 1.0 involves improper sanitization of the ID argument in the /edit_subjecta.php file, enabling remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. Exploit code is publicly available, increasing the risk of exploitation. No official fix or patch has been disclosed by the vendor as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact on confidentiality, integrity, and availability is limited but present. Since the vulnerability requires no privileges or user interaction, it can be exploited remotely by unauthenticated attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /edit_subjecta.php endpoint. Avoid exposing the vulnerable functionality publicly if possible.