CVE-2026-86225: SQL Injection in SourceCodester Class and Exam Timetabling System

The vulnerability CVE-2026-86225 affects SourceCodester Class and Exam Timetabling System 1.0. It arises from insufficient input validation of the room_name argument in the mysqli_query call in /admin/modal_add_room.php, enabling remote SQL injection attacks. This can allow attackers to manipulate backend database queries. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data access, modification, or deletion, potentially compromising the confidentiality and integrity of the system's data. Availability impact is limited. No reports of active exploitation in the wild are known at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected functionality, implement web application firewalls with SQL injection detection, and sanitize inputs at the application level to mitigate risk.