A critical SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 poses a significant risk of unauthorized database access and potential data manipulation.

This is a SQL injection vulnerability (CWE-89) affecting the 'ID' parameter within files such as '/edit_coursea.php'. The vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive application data, potential modification of timetabling records, or administrative bypass. Given the CVSS score of 7.3, this flaw is categorized as High severity; while the score reflects the specific impact on confidentiality and integrity, the ability for remote, unauthenticated exploitation significantly elevates the operational risk to the organization.

Immediate Action: Since an official patch is currently unavailable, organizations should restrict network access to the affected application and disable the vulnerable components if possible.

Proactive Monitoring: Monitor web server access logs and database audit logs for anomalous query patterns, such as unexpected SQL syntax or unauthorized attempts to access system tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection signatures targeting the application's input parameters.

Public Exploit Available: true

Due to the presence of public exploit code and the ease of remote exploitation, this vulnerability requires immediate attention. IT administrators must implement compensating controls such as WAF filtering to mitigate the risk and proactively monitor for signs of unauthorized database interaction until a definitive security update is provided by the vendor.