A critical SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0 allows unauthenticated attackers to potentially compromise database integrity and confidentiality.

The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize user-supplied input. This flaw is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/PR:N.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive institutional data, modification of exam schedules, or complete database compromise. Given the CVSS score of 7.3, this represents a significant risk to the integrity and availability of the timetabling system and the information stored within it.

Immediate Action: Contact the vendor for available security patches or updates to address this injection flaw.

Proactive Monitoring: Inspect web server logs for suspicious URL patterns containing SQL syntax or unusual query strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads.

Public Exploit Available: Unknown.

Organizations utilizing this software must treat this as a high-priority risk. Until a vendor-supplied patch is identified and applied, ensure that strict input validation is enforced and that the database user permissions follow the principle of least privilege to limit the impact of a potential breach.