A critical SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System allows unauthenticated remote attackers to compromise the underlying database.

The application is vulnerable to SQL injection due to improper sanitization of the sy parameter in the modal_add_schoolyr.php file. This flaw allows an unauthenticated attacker to inject malicious SQL commands directly into the database query, facilitating unauthorized data access or manipulation.

Successful exploitation of this vulnerability could lead to a complete compromise of the application database, including the theft of sensitive institutional data, unauthorized administrative access, and potential system downtime. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to data confidentiality and integrity, potentially resulting in severe reputational damage and operational disruption.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected web application or disable the vulnerable module until a fix is provided by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous POST requests directed at modal_add_schoolyr.php, particularly those containing SQL syntax characters like single quotes, semicolons, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting POST parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, documented in the security researcher's write-up on GitHub.

Given the exposure of the database to unauthenticated remote attackers, this vulnerability must be treated with high priority. Organizations utilizing this software should implement network-level access controls to isolate the application immediately and transition to a hardened configuration or alternative solution until the vendor releases a formal security update.