A critical SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System allows unauthenticated attackers to access or modify sensitive database information.

The application is susceptible to SQL injection (CWE-89) and general injection (CWE-74) attacks, allowing an unauthenticated attacker to execute arbitrary database queries.

This vulnerability poses a severe risk to data confidentiality and integrity. An attacker could extract sensitive student or faculty information, modify exam schedules, or potentially gain further unauthorized access to the underlying server. Given the 7.3 CVSS score, the potential for data breaches and reputational damage is substantial.

Immediate Action: Since no official patch is currently available, restrict access to the application via network-level controls or by disabling the service until a secure version is released.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected SQL keywords (e.g., UNION, SELECT, OR 1=1) originating from web requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection attack signatures targeting the application.

Public Exploit Available: Unknown

Due to the absence of a vendor-provided patch, users should consider this software insecure for production use. If continued use is required, implement immediate network isolation and robust WAF filtering to prevent exploitation of this high-risk injection vulnerability.