A critical SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to compromise the backend database.

This SQL injection vulnerability exists in the /edit_product.php file. The application fails to properly sanitize the 'ID' argument, enabling unauthenticated remote attackers to inject and execute arbitrary SQL commands.

Exploitation of this vulnerability allows for unauthorized data access and potential modification of the application database. Given the CVSS score of 7.3, this flaw poses a substantial risk to the confidentiality and integrity of institutional data handled by the timetabling system.

Immediate Action: Apply vendor security updates as soon as they become available. If updates are delayed, restrict access to the /edit_product.php file to trusted network segments only.

Proactive Monitoring: Monitor web traffic and database logs for unusual patterns or SQL syntax errors that may indicate an active injection attempt.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and sanitize input parameters, specifically looking for malicious SQL injection payloads in the 'ID' field.

Public Exploit Available: true

This vulnerability represents a significant security oversight. Organizations must prioritize restricting access to the affected system and applying the latest security updates provided by SourceCodester to prevent unauthorized database interaction and potential data breach.