An unauthenticated SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to compromise the underlying database and potentially gain full control of the application.

This vulnerability is a SQL injection flaw located in the /admin/modal_add_room2.php file, where the room_name parameter is concatenated directly into database queries without sanitization. An unauthenticated attacker can exploit this via a crafted POST request to execute arbitrary SQL commands.

Successful exploitation permits unauthorized access to the application database, which can lead to the exfiltration of sensitive student and exam data, data tampering, or total system compromise. Given the CVSS score of 7.3, this represents a high-risk scenario where an attacker can bypass all authentication controls to manipulate the system backend.

Immediate Action: As there is no official patch available, administrators should restrict network access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Monitor web server logs for suspicious POST requests to /admin/modal_add_room2.php containing SQL syntax characters, such as single quotes, semicolons, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP POST parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the researcher write-up at the referenced GitHub repository.

Due to the lack of a vendor-provided patch, users of this software should consider the system highly exposed. It is strongly recommended to isolate the application from the public internet immediately and transition to a more secure, actively maintained alternative if a vendor update is not released promptly to address this critical flaw.