An unauthenticated SQL injection vulnerability in the Class and Exam Timetabling System allows remote attackers to compromise the underlying database and gain unauthorized control over the application.

This is a SQL injection vulnerability (CWE-89) located in the /admin/modal_add_room.php file. The application fails to sanitize the room_name parameter before passing it to a mysqli_query function, allowing an unauthenticated attacker to manipulate database queries.

Successful exploitation of this vulnerability permits unauthorized access to the application database, which may result in sensitive data leakage, data destruction, or complete system compromise. Given the CVSS score of 7.3, this flaw poses a high risk to business continuity and data integrity, especially as the attack vector requires no authentication, making it trivial to execute against exposed instances.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or disable the vulnerable module until a fix is provided by the vendor.

Proactive Monitoring: Monitor web server access logs for suspicious POST requests to /admin/modal_add_room.php, particularly those containing SQL syntax or unusual characters in the room_name field.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize input containing common SQL injection patterns targeting the room_name parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up by the researcher on GitHub.

Due to the lack of a vendor-supplied patch and the availability of a public proof-of-concept, this vulnerability should be treated with high urgency. Organizations utilizing this system must implement immediate network-level protections or WAF filtering to prevent unauthorized database access while awaiting a formal security update from the developer.