The Class and Exam Timetabling System version 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries and potentially compromise the entire application.

The application fails to sanitize the course parameter in the /admin/modal_add_course2.php file before passing it to a mysqli_query function. This flaw allows an unauthenticated attacker to inject malicious SQL syntax directly into the backend database.

Successful exploitation of this vulnerability grants an attacker unauthorized access to the underlying database. This can lead to the exfiltration of sensitive institutional data, unauthorized modification of exam or class schedules, and potential full system compromise. Given the CVSS score of 7.3, this represents a significant risk to data integrity and operational continuity, especially in an academic or administrative environment.

Immediate Action: As no official patch is currently available from the vendor, users are strongly advised to restrict access to the /admin/ directory using network-level controls or web server authentication until a fix is released.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /admin/modal_add_course2.php containing unusual characters such as single quotes, semicolons, or SQL keywords like UNION or SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST parameters to mitigate the risk of exploitation.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented by the researcher in the referenced GitHub repository.

This vulnerability poses a high risk due to the lack of required authentication for exploitation and the availability of public proof-of-concept code. Administrators should prioritize isolating the affected component from the public internet. If this system is critical, consider implementing input validation routines directly into the source code as a temporary measure until an official update is provided by the vendor.