The SourceCodester Class and Exam Timetabling System is vulnerable to unauthenticated SQL injection, which could allow an attacker to compromise the underlying database.

This is an SQL injection vulnerability (CWE-89) located in the /admin/modal_add_course1.php file. An unauthenticated attacker can supply malicious input via the course POST parameter, which is concatenated directly into a database query without proper sanitization.

Successful exploitation of this flaw enables an attacker to gain unauthorized access to the backend database, potentially resulting in the exfiltration of sensitive student or exam information, data tampering, or full system compromise. While the CVSS score of 7.3 indicates a high severity, the ability for an unauthenticated attacker to interact with the database remotely represents a significant risk to organizational data integrity and operational continuity.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /admin/ directory or disable the affected application until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /admin/modal_add_course1.php, specifically searching for SQL syntax patterns or time-based blind injection payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP POST parameters.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the researcher's GitHub issue report.

Given the availability of a public proof-of-concept and the lack of an official patch, this system should be considered high-risk. Organizations currently running version 1.0 of the Class and Exam Timetabling System must implement strict access controls or isolate the application from the public internet immediately to prevent potential database compromise.