A critical SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System 1.0 exposes the application to unauthenticated database manipulation and potential data compromise.

The application is susceptible to SQL injection (CWE-89), a flaw where untrusted input is improperly neutralized before being used in database queries. This vulnerability is exploitable by unauthenticated attackers over the network.

Successful exploitation of this SQL injection vulnerability could allow unauthorized actors to read, modify, or delete sensitive data stored within the backend database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to unauthorized access to academic or personal information managed by the system.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the application and monitor for suspicious SQL-related traffic patterns.

Proactive Monitoring: Review application access logs for unusual input characters, such as single quotes, semicolons, or SQL keywords, which may indicate attempted injection attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the application endpoints.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data sources.

Given the exposure of the database to unauthenticated remote attackers, immediate defensive measures are required. Organizations should prioritize isolating the affected system from public-facing networks until a vendor-supplied security update is released and verified for deployment.