The Class and Exam Timetable Management application is vulnerable to remote SQL injection, which allows unauthenticated attackers to compromise database integrity and potentially access sensitive data.

This vulnerability is a SQL injection flaw located within the preview7.php file. An unauthenticated attacker can trigger the vulnerability by manipulating the course_year_section/semester argument to execute arbitrary SQL commands.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to the underlying database, potentially resulting in the loss, theft, or corruption of sensitive academic and user information. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, particularly for environments storing student or faculty records.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected web application or disable the vulnerable component until a security update is provided by the vendor.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax or unusual database query patterns originating from untrusted sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection attempts and malicious input patterns targeting the /preview7.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

The severity of this SQL injection vulnerability requires immediate attention despite the lack of a vendor-provided patch. Organizations using the Class and Exam Timetable Management software must prioritize isolating the affected instance or applying strict network-level access controls to prevent unauthenticated access, as the existence of public exploit code significantly lowers the barrier for potential attackers.