An unauthenticated SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System allows remote attackers to manipulate database queries and potentially access sensitive data.

The application improperly sanitizes the ID parameter within the /edit_exam.php script. This flaw allows unauthenticated remote attackers to inject malicious SQL commands, enabling unauthorized interaction with the underlying database.

With a CVSS score of 7.3 (High), this vulnerability poses a significant risk to the integrity and confidentiality of academic data stored within the system. Successful exploitation could lead to unauthorized data extraction, modification of exam records, or complete database compromise.

Immediate Action: Check for official updates from SourceCodester and apply them immediately. If no patch is available, implement parameterized queries or prepared statements in the source code to neutralize SQL injection vectors.

Proactive Monitoring: Monitor application logs for suspicious database query strings or high volumes of unexpected database error messages which may indicate automated scanning or injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block requests containing SQL injection payloads targeting the ID parameter.

Public Exploit Available: True

The severity of this vulnerability necessitates immediate attention. Organizations should audit their deployment of the Class and Exam Timetabling System and apply all available security updates to prevent potential data breaches resulting from SQL injection.