CVE-2026-14734: SQL Injection in SourceCodester Class and Exam Timetabling System

A high-severity SQL injection vulnerability, identified as CVE-2026-14734, has been discovered in the SourceCodester Class and Exam Timetabling System version 1.0. The flaw is located in an unspecified function within the /edit_product.php file, where improper input sanitization allows an attacker to inject malicious SQL commands by manipulating the 'ID' argument. This vulnerability enables remote exploitation, meaning attackers can leverage it without requiring prior authentication or local access to the system. The existence of a publicly disclosed exploit significantly increases the immediate risk to organizations using this software, making them prime targets for data compromise, unauthorized access, and potential system control. Defenders should prioritize patching and monitoring for exploitation attempts against this critical web application flaw.

Attack Chain

1. Reconnaissance & Vulnerability Identification: An attacker identifies an internet-facing instance of SourceCodester Class and Exam Timetabling System 1.0 and notes the presence of the /edit_product.php endpoint.
2. Payload Crafting: The attacker crafts a specially designed HTTP GET or POST request containing SQL injection payloads, such as single quotes, comments, or boolean-based conditions, within the ID parameter targeting the /edit_product.php file.
3. Initial Access (Injection): The crafted HTTP request is sent to the vulnerable web application.
4. Database Interaction: The application processes the unsanitized ID argument, leading to the execution of the attacker's injected SQL query by the backend database.
5. Information Disclosure / Privilege Escalation: The attacker exploits the SQL injection to extract sensitive database content (e.g., user credentials, system configuration, academic records) or, if possible, escalate privileges within the database server.
6. Impact (Data Exfiltration/Manipulation): The attacker exfiltrates collected data or uses the SQL injection to modify, delete, or insert data directly into the database, achieving confidentiality and integrity compromise.
7. Optional Persistence/RCE: Depending on the underlying database and server configuration, the attacker might leverage advanced SQL injection techniques (e.g., xp_cmdshell on MSSQL, LOAD_FILE/INTO OUTFILE on MySQL) to achieve remote code execution or establish persistence on the web server.

Impact

Successful exploitation of CVE-2026-14734 can lead to significant compromise of the SourceCodester Class and Exam Timetabling System. Attackers can gain unauthorized access to the application's database, leading to potential exfiltration of sensitive information such as student records, exam schedules, class data, and potentially user credentials. This can result in privacy breaches, academic disruption, and reputational damage for educational institutions or organizations utilizing the system. The vulnerability allows for data manipulation, which could lead to altered schedules, grades, or other critical information, causing operational chaos and distrust. With a CVSS v3.1 score of 7.3 (High) and a publicly available exploit, the risk of widespread compromise is substantial.

Recommendation

• Immediately apply any available patches or updates for SourceCodester Class and Exam Timetabling System 1.0 to address CVE-2026-14734.
• Deploy the Sigma rule provided in this brief to your SIEM/logging solution to detect attempts to exploit CVE-2026-14734.
• Review web server logs for suspicious requests to /edit_product.php containing SQL injection payloads, and consider implementing a Web Application Firewall (WAF) to filter malicious input for /edit_product.php.
• Block network access to the domains listed in the IOC table at the perimeter firewall or proxy if not legitimately accessed.