An unauthenticated SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate database queries and compromise system data.

This is a SQL injection vulnerability (CWE-89) located in the /admin/modal_add_rooma.php file. The application fails to sanitize the room_name parameter before concatenating it into a database query, which can be triggered by an unauthenticated remote attacker.

Successful exploitation of this vulnerability can lead to unauthorized database access, sensitive data exfiltration, and potential full system compromise. Given the CVSS score of 7.3, the risk is classified as High: it allows attackers to bypass security boundaries, potentially leading to significant data loss or service disruption.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application, particularly the /admin/ directory, to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for suspicious POST requests to /admin/modal_add_rooma.php containing SQL-related keywords or time-based payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST parameters.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the researcher's GitHub write-up.

Due to the availability of public exploit material and the lack of a vendor-supplied patch, this system should be considered highly vulnerable. Administrators must isolate the affected installation from the public internet immediately and implement strict input validation or WAF-based filtering to prevent unauthorized database interactions until a formal security update is released.