CVE-2026-86223: SQL Injection in SourceCodester Class and Exam Timetabling System

The vulnerability CVE-2026-86223 exists in SourceCodester Class and Exam Timetabling System 1.0. It arises from improper sanitization of the 'course' parameter passed to the mysqli_query function in the file /admin/modal_add_coursea.php, enabling SQL injection attacks. This allows remote attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) and does not require privileges or user interaction to exploit. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability can allow remote attackers to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, data modification, or other impacts depending on the database and application context. The vulnerability does not require authentication or user interaction, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation and sanitization on the 'course' parameter to prevent SQL injection. Monitoring for exploit attempts and restricting access to the vulnerable endpoint may reduce risk.