An unauthenticated SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 poses a critical risk of unauthorized database access and potential system compromise.

This vulnerability is a SQL injection flaw located in the /admin/modal_add_course.php file. The application fails to properly sanitize the course parameter before passing it to a mysqli_query function, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries against the underlying database. This could lead to sensitive data exposure, unauthorized modification or deletion of institutional data, and potential compromise of the entire application environment. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent significant operational and data integrity impacts.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or web server authentication.

Proactive Monitoring: Monitor web server logs for suspicious POST requests to /admin/modal_add_course.php containing SQL syntax or unusual string patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the course parameter.

Public Exploit Available: Yes, a proof-of-concept exists as detailed in the researcher's GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to any organization running this software. Administrators must implement compensating controls, such as WAF rules or access restrictions, immediately to mitigate the risk until an official patch is provided by the vendor. Prioritize the isolation of the affected system to prevent unauthorized access to the backend database.