An unauthenticated SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to compromise database integrity and access sensitive data.

This is a SQL injection vulnerability located in the /delete_subject.php file. The application fails to sanitize the id parameter in GET requests, allowing an unauthenticated attacker to manipulate SQL queries executed against the backend database.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary SQL commands, which can lead to unauthorized data extraction, modification, or deletion. Given the CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of academic or administrative data managed by the system, potentially resulting in severe reputational damage and operational disruption.

Immediate Action: As there is no official patch available, administrators should restrict network access to the /delete_subject.php endpoint or disable the affected functionality entirely until the vendor provides a secure update.

Proactive Monitoring: Security teams should review web server access logs for suspicious GET requests to /delete_subject.php containing SQL syntax or unusual characters in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting the id parameter in HTTP GET requests.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the vulnerability report linked by the CVE record.

The presence of a public proof-of-concept makes this vulnerability a high-priority risk. Organizations using this software must immediately implement access controls or network-level filtering to mitigate the threat of unauthorized database manipulation, as no official vendor patch is currently available to resolve the underlying code flaw.