An unauthenticated SQL injection vulnerability in the Class and Exam Timetabling System allows remote attackers to compromise the underlying database, posing a critical risk to data integrity and confidentiality.

The application fails to sanitize the course parameter in the /admin/modal_add_coursea.php file before including it in a mysqli_query statement. This vulnerability is exploitable by an unauthenticated remote attacker who can inject malicious SQL payloads to manipulate database queries.

Successful exploitation permits unauthorized access to the backend database, potentially leading to the theft of sensitive institutional data, unauthorized modification of exam schedules, or complete system compromise. With a CVSS score of 7.3, this high-severity vulnerability represents a significant threat to business continuity and the integrity of academic records, especially given the ease of access for unauthenticated parties.

Immediate Action: As no official vendor patch is currently confirmed, administrators should immediately restrict access to the /admin/ directory using network-level controls or IP allowlisting to prevent unauthenticated access.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /admin/modal_add_coursea.php, specifically monitoring for SQL syntax, comments, or time-based delay patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, particularly focusing on input parameters submitted to the administrative modules.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the researcher's GitHub repository.

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability poses an immediate risk to the affected system. Organizations using this software should prioritize isolating the application from external networks and conducting a thorough security audit of the source code to implement prepared statements, which will effectively neutralize this injection vector.