Class and Exam Timetabling System 1.0 - CraftedSignal Threat Feed

CVE-2026-14771: SourceCodester Class and Exam Timetabling System SQL Injection Vulnerability

hello@craftedsignal.io — Sun, 05 Jul 2026 22:21:20 +0000

A high-severity SQL injection vulnerability, identified as CVE-2026-14771, affects SourceCodester Class and Exam Timetabling System version 1.0. The flaw resides within an unknown function of the /edit_exam1.php file, specifically when processing the ID argument. This vulnerability allows a remote, unauthenticated attacker to inject malicious SQL queries by manipulating the ID parameter. The exploitation of this vulnerability can lead to unauthorized access to sensitive data, data manipulation, and potentially remote code execution on the underlying database server, severely compromising the system's confidentiality, integrity, and availability. An exploit for CVE-2026-14771 has been publicly published, significantly increasing the risk of widespread exploitation against vulnerable instances of the system. Defenders should prioritize patching and implementing robust web application security measures.

Attack Chain

A remote, unauthenticated attacker identifies a vulnerable SourceCodester Class and Exam Timetabling System 1.0 instance, often exposed to the internet.
The attacker crafts a malicious HTTP POST request targeting the /edit_exam1.php endpoint.
The request includes a specially formulated SQL injection payload within the ID argument, designed to bypass input sanitization.
The vulnerable web application processes the unsanitized ID argument, causing the embedded malicious SQL query to be executed by the backend database.
Depending on the payload, the attacker can achieve information disclosure (e.g., extracting user credentials, sensitive system data), data manipulation (e.g., altering schedules, grades), or potentially escalate privileges.
In certain database configurations (e.g., xp_cmdshell on MSSQL or sys_exec on MySQL), the attacker might achieve remote code execution on the server hosting the database.
The successful exploitation leads to compromise of application data, system control, and potential further lateral movement within the network.

Impact

Successful exploitation of CVE-2026-14771 allows attackers to gain unauthorized control over the application's backend database. This can result in significant data breaches, including exposure of student and faculty information, exam schedules, and administrative credentials. The integrity of timetables and exam records could be compromised, leading to operational disruption and reputational damage for educational institutions using the system. With a CVSS v3.1 base score of 7.3 (High), the vulnerability poses a substantial risk, especially given that a public exploit exists, increasing the likelihood of widespread, opportunistic attacks by various threat actors.

Recommendation

Immediately apply patches or vendor-provided updates for SourceCodester Class and Exam Timetabling System 1.0 to address CVE-2026-14771.
Deploy the provided Sigma rule to your SIEM to detect attempts at exploiting CVE-2026-14771.
Implement or update Web Application Firewall (WAF) rules to detect and block common SQL injection patterns, especially targeting the /edit_exam1.php endpoint and ID parameter.
Review web server logs for suspicious HTTP requests containing SQL injection payloads, as indicated in the provided Sigma rule.

CVE-2026-14770: SourceCodester Class and Exam Timetabling System SQL Injection Vulnerability

hello@craftedsignal.io — Sun, 05 Jul 2026 21:25:11 +0000

A critical SQL injection vulnerability, tracked as CVE-2026-14770, has been publicly disclosed and affects SourceCodester Class and Exam Timetabling System version 1.0. This flaw resides in the /edit_room.php endpoint where improper neutralization of special elements in the 'ID' argument allows for remote code execution. Attackers can manipulate this parameter to inject malicious SQL queries into the application's backend database. This vulnerability is remotely exploitable without authentication, meaning threat actors can target vulnerable instances directly over the network. Crucially, the exploit code for this vulnerability is now public, significantly increasing the risk of widespread exploitation by various threat actors. Defenders must prioritize patching or mitigating this vulnerability immediately to prevent unauthorized access to sensitive data and potential system compromise.

Attack Chain

An unauthenticated attacker identifies a vulnerable instance of SourceCodester Class and Exam Timetabling System 1.0, typically by scanning for known application signatures or default paths.
The attacker crafts a specially designed HTTP GET request targeting the /edit_room.php endpoint on the vulnerable system.
Within the HTTP request, the ID parameter is modified to include SQL injection payloads (e.g., id=1 UNION SELECT USER(), DATABASE(), VERSION() --).
The vulnerable application processes the malicious ID parameter, which results in the backend database executing the injected SQL query.
The database's response, now containing the results of the attacker's query, is returned within the legitimate HTTP response, inadvertently disclosing sensitive information (e.g., database username, current database name, system version).
The attacker parses the HTTP response to extract the sensitive data.
The attacker continues to refine payloads, potentially pivoting to other SQL injection techniques like time-based blind SQLi, out-of-band SQLi, or error-based SQLi to fully enumerate and exfiltrate database contents.
Depending on database permissions and configuration, the attacker might achieve remote code execution via database functionalities (e.g., xp_cmdshell on MSSQL, LOAD_FILE/INTO OUTFILE on MySQL) to establish persistence or further compromise the underlying server.

Impact

A successful exploitation of CVE-2026-14770 leads to significant impact on the confidentiality, integrity, and availability of data stored within the application's database. Attackers can exfiltrate sensitive information, such as user credentials, student records, timetable details, and other proprietary data. The integrity of the application's data can be compromised through unauthorized modification or deletion of records. In scenarios where the database user has elevated privileges or the database system allows for file operations or command execution, attackers could potentially escalate their access to the underlying server, leading to a complete system compromise, ransomware deployment, or further network lateral movement. Given the public availability of exploit code, a wide range of organizations using this system are at high risk of immediate targeting.

Recommendation

Prioritize patching SourceCodester Class and Exam Timetabling System to a version that remediates CVE-2026-14770 as soon as it becomes available.
Deploy the Sigma rule provided in this brief to your SIEM/detection platform to identify and alert on attempted exploitation of CVE-2026-14770.
Implement Web Application Firewalls (WAFs) with rules specifically designed to detect and block SQL injection payloads targeting the /edit_room.php endpoint, referencing the techniques described in the attack chain.
Review webserver access logs for anomalous requests to /edit_room.php containing SQLi patterns as described in the detection rule, even if no patch is immediately available.

CVE-2026-14734: SQL Injection in SourceCodester Class and Exam Timetabling System

hello@craftedsignal.io — Sun, 05 Jul 2026 10:22:13 +0000

A high-severity SQL injection vulnerability, identified as CVE-2026-14734, has been discovered in the SourceCodester Class and Exam Timetabling System version 1.0. The flaw is located in an unspecified function within the /edit_product.php file, where improper input sanitization allows an attacker to inject malicious SQL commands by manipulating the 'ID' argument. This vulnerability enables remote exploitation, meaning attackers can leverage it without requiring prior authentication or local access to the system. The existence of a publicly disclosed exploit significantly increases the immediate risk to organizations using this software, making them prime targets for data compromise, unauthorized access, and potential system control. Defenders should prioritize patching and monitoring for exploitation attempts against this critical web application flaw.

Attack Chain

Reconnaissance & Vulnerability Identification: An attacker identifies an internet-facing instance of SourceCodester Class and Exam Timetabling System 1.0 and notes the presence of the /edit_product.php endpoint.
Payload Crafting: The attacker crafts a specially designed HTTP GET or POST request containing SQL injection payloads, such as single quotes, comments, or boolean-based conditions, within the ID parameter targeting the /edit_product.php file.
Initial Access (Injection): The crafted HTTP request is sent to the vulnerable web application.
Database Interaction: The application processes the unsanitized ID argument, leading to the execution of the attacker's injected SQL query by the backend database.
Information Disclosure / Privilege Escalation: The attacker exploits the SQL injection to extract sensitive database content (e.g., user credentials, system configuration, academic records) or, if possible, escalate privileges within the database server.
Impact (Data Exfiltration/Manipulation): The attacker exfiltrates collected data or uses the SQL injection to modify, delete, or insert data directly into the database, achieving confidentiality and integrity compromise.
Optional Persistence/RCE: Depending on the underlying database and server configuration, the attacker might leverage advanced SQL injection techniques (e.g., xp_cmdshell on MSSQL, LOAD_FILE/INTO OUTFILE on MySQL) to achieve remote code execution or establish persistence on the web server.

Impact

Successful exploitation of CVE-2026-14734 can lead to significant compromise of the SourceCodester Class and Exam Timetabling System. Attackers can gain unauthorized access to the application's database, leading to potential exfiltration of sensitive information such as student records, exam schedules, class data, and potentially user credentials. This can result in privacy breaches, academic disruption, and reputational damage for educational institutions or organizations utilizing the system. The vulnerability allows for data manipulation, which could lead to altered schedules, grades, or other critical information, causing operational chaos and distrust. With a CVSS v3.1 score of 7.3 (High) and a publicly available exploit, the risk of widespread compromise is substantial.

Recommendation

Immediately apply any available patches or updates for SourceCodester Class and Exam Timetabling System 1.0 to address CVE-2026-14734.
Deploy the Sigma rule provided in this brief to your SIEM/logging solution to detect attempts to exploit CVE-2026-14734.
Review web server logs for suspicious requests to /edit_product.php containing SQL injection payloads, and consider implementing a Web Application Firewall (WAF) to filter malicious input for /edit_product.php.
Block network access to the domains listed in the IOC table at the perimeter firewall or proxy if not legitimately accessed.

CVE-2026-14733: Remote SQL Injection in SourceCodester Class and Exam Timetabling System

hello@craftedsignal.io — Sun, 05 Jul 2026 09:19:46 +0000

A significant SQL injection vulnerability, tracked as CVE-2026-14733, has been identified in SourceCodester Class and Exam Timetabling System version 1.0. This flaw, rated with a CVSS v3.1 base score of 7.3 (High), resides within the /edit_coursea.php component, where it improperly processes the ID argument. Exploitation is trivial for an unauthenticated attacker, allowing for remote SQL command execution. The vulnerability is critical for defenders as an exploit has been publicly disclosed and is actively available, increasing the likelihood of widespread exploitation. Organizations using this specific version of the Timetabling System are at immediate risk of data breaches and system compromise if not promptly patched.

Attack Chain

Initial Access: An unauthenticated attacker sends an HTTP GET request directly to the /edit_coursea.php endpoint of the vulnerable SourceCodester Class and Exam Timetabling System 1.0 web application.
Exploitation Trigger: The attacker crafts the ID parameter in the HTTP GET request to include SQL injection payloads, such as ?ID=1%20UNION%20SELECT%20... or ?ID=1%27%20OR%201=1%20--%20.
Database Query Manipulation: The web application's /edit_coursea.php script processes the unsanitized ID parameter directly within a SQL query designed to retrieve course information.
SQL Execution: The injected SQL payload is executed by the backend database, allowing the attacker to bypass authentication, query arbitrary tables, modify existing data, or potentially delete database entries.
Information Disclosure/Modification: Depending on the crafted payload, the attacker can exfiltrate sensitive data (e.g., user credentials, course details) from the database or alter existing records, leveraging the database's permissions.
Potential Remote Code Execution: If the backend database user has elevated privileges or the specific database system (e.g., SQL Server, MySQL, PostgreSQL) supports arbitrary command execution via SQL (e.g., xp_cmdshell, LOAD_FILE/INTO OUTFILE, COPY TO PROGRAM), the attacker might achieve remote code execution on the underlying server.
Impact Achieved: The attacker gains unauthorized access to and control over database contents, leading to breaches of data confidentiality, integrity compromise (data alteration/deletion), and potentially full system compromise.

Impact

Successful exploitation of CVE-2026-14733 can lead to severe consequences for affected organizations. Attackers can gain unauthorized access to the application's entire database, potentially exfiltrating sensitive information such as student records, course schedules, faculty details, and user credentials. Data integrity can be compromised through unauthorized modification or deletion of critical academic data. In scenarios where the database user has elevated privileges or the database engine allows OS command execution via SQL injection, attackers could achieve full remote code execution on the underlying server, leading to complete system compromise and further network penetration. Given the public availability of an exploit, any organization running the vulnerable version is at high risk of active exploitation.

Recommendation

Immediately patch or upgrade SourceCodester Class and Exam Timetabling System to a non-vulnerable version to mitigate CVE-2026-14733.
Deploy the provided Sigma rule to your SIEM to detect attempted exploitation of CVE-2026-14733 via unusual HTTP GET requests to /edit_coursea.php with SQL injection payloads.
Review web server access logs for any suspicious requests targeting /edit_coursea.php with malformed ID parameters prior to patching.

CVE-2026-14732: SQL Injection in SourceCodester Class and Exam Timetabling System

hello@craftedsignal.io — Sun, 05 Jul 2026 09:18:49 +0000

A critical SQL injection vulnerability (CVE-2026-14732) has been publicly disclosed in SourceCodester Class and Exam Timetabling System version 1.0. This flaw, residing in the /edit_exam.php file, allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database by manipulating the ID argument. The vulnerability was published to NVD on July 5, 2026, with a CVSS v3.1 base score of 7.3 (High). The public disclosure of exploit details means that this vulnerability can be actively leveraged by malicious actors. Organizations using this system are at immediate risk of data compromise, unauthorized access, and potential remote code execution, making prompt remediation crucial for protecting sensitive information and maintaining system integrity. This affects any instance exposed to the internet.

Attack Chain

Attacker identifies an internet-facing instance of SourceCodester Class and Exam Timetabling System 1.0.
Attacker crafts a specially formed HTTP GET or POST request targeting the /edit_exam.php endpoint.
The request includes a malicious SQL payload within the ID argument (e.g., id=1%27+UNION+SELECT+null,user(),null--).
The vulnerable application processes this request without properly sanitizing the ID input, causing the web server to execute the attacker's embedded SQL query against its backend database.
The database responds to the malicious query, potentially revealing sensitive data such as user credentials, database schema, or other confidential information.
The web server includes the results of the SQL query within the HTTP response, allowing the attacker to exfiltrate the compromised data.

Impact

Successful exploitation of CVE-2026-14732 can lead to severe consequences for organizations utilizing SourceCodester Class and Exam Timetabling System 1.0. Attackers can exfiltrate sensitive student and faculty data, manipulate existing records, or gain administrative access to the application. This could result in privacy breaches, academic fraud, disruption of critical scheduling operations, and reputational damage. The public availability of exploit details increases the likelihood of widespread targeting and automated attacks against vulnerable systems, posing a significant risk to affected educational institutions or internal training departments.

Recommendation

Patch CVE-2026-14732 on all affected SourceCodester Class and Exam Timetabling System 1.0 instances immediately.
Deploy the provided Sigma rule to your SIEM to detect exploitation attempts targeting /edit_exam.php.
Review web server access logs for SourceCodester Class and Exam Timetabling System 1.0 for requests to /edit_exam.php containing suspicious ID parameters indicative of SQL injection.

CVE-2026-14642: SourceCodester Class and Exam Timetabling System SQL Injection

hello@craftedsignal.io — Sat, 04 Jul 2026 19:24:10 +0000

A significant vulnerability, tracked as CVE-2026-14642, has been discovered in SourceCodester Class and Exam Timetabling System version 1.0. This flaw specifically affects an unknown functionality within the /edit_class2.php file, where improper handling of the ID argument allows for SQL injection. The vulnerability can be exploited remotely by an unauthenticated attacker, posing a substantial risk to organizations utilizing this system. The public availability of an exploit intensifies the threat, making it highly probable for malicious actors to leverage this weakness for unauthorized access to sensitive database information, data manipulation, or even further system compromise. Defenders must prioritize patching or mitigating this vulnerability immediately to prevent potential data breaches and system integrity compromises.

Attack Chain

An unauthenticated attacker identifies a SourceCodester Class and Exam Timetabling System 1.0 instance accessible over the internet.
The attacker crafts a specially malformed HTTP GET request targeting the /edit_class2.php endpoint.
The attacker manipulates the ID argument in the URL query string by injecting SQL metacharacters and payloads (e.g., ' OR 1=1--).
The vulnerable application processes this request without proper input validation, incorporating the malicious payload directly into a database query.
The backend database executes the attacker-controlled SQL query, potentially disclosing sensitive data, modifying existing records, or executing arbitrary commands (if the database user has sufficient privileges).
The application responds to the attacker with the results of the executed SQL query, allowing for data exfiltration or confirmation of successful command execution.
The attacker extracts sensitive information from the database or uses the RCE capabilities to establish persistence or pivot further into the network.

Impact

Successful exploitation of CVE-2026-14642 can lead to severe consequences for affected organizations. Attackers can gain unauthorized access to the application's underlying database, potentially exfiltrating sensitive student or class scheduling data, modifying records, or even deleting critical information. Given the nature of SQL injection, this could result in a complete compromise of confidentiality, integrity, and availability of the application's data. As the exploit is publicly available, organizations running the affected version are at immediate risk of data breaches and operational disruption. The CVSS score of 7.3 (High) reflects the significant potential for impact.

Recommendation

Patch CVE-2026-14642 by upgrading SourceCodester Class and Exam Timetabling System to a version where this vulnerability has been fixed, if available, or applying vendor-supplied patches immediately.
Implement a Web Application Firewall (WAF) to detect and block malicious HTTP requests targeting /edit_class2.php with SQL injection payloads, as indicated by the Sigma rule below.
Deploy the Sigma rule titled "Detect CVE-2026-14642 Exploitation — SourceCodester SQL Injection" to your SIEM and tune for your environment, ensuring it triggers on requests to /edit_class2.php with suspicious ID parameters.
Review web server logs for /edit_class2.php access patterns, especially for cs-uri-query fields containing SQL injection artifacts, to identify potential exploitation attempts.
Implement strict input validation for all user-supplied input, especially for the ID parameter used in /edit_class2.php, to prevent SQL injection.

SQL Injection in SourceCodester Class and Exam Timetabling System (CVE-2026-14641)

hello@craftedsignal.io — Sat, 04 Jul 2026 19:23:20 +0000

A high-severity SQL injection vulnerability, tracked as CVE-2026-14641, has been identified in SourceCodester Class and Exam Timetabling System version 1.0. This flaw allows unauthenticated, remote attackers to execute arbitrary SQL commands by manipulating the 'ID' argument within the /edit_course.php file. The vulnerability stems from improper neutralization of special elements in SQL commands, specifically CWE-89. The exploit has been publicly disclosed and is actively available, increasing the risk of widespread exploitation. This vulnerability enables attackers to potentially read, modify, or delete data from the backend database, compromising data confidentiality and integrity. Defenders should prioritize patching and implementing robust input validation to mitigate this threat.

Attack Chain

An unauthenticated attacker crafts a malicious HTTP GET request targeting the /edit_course.php endpoint of the vulnerable SourceCodester Class and Exam Timetabling System.
The crafted request includes a specially malformed ID parameter in the URL query string, containing SQL injection payloads (e.g., ID=1%27%20UNION%20SELECT%20...).
The vulnerable /edit_course.php script processes the ID parameter without proper input sanitization or validation.
The application directly embeds the malicious ID parameter's value into a backend SQL query.
The database server executes the manipulated SQL query, which may bypass intended logic and allow the attacker to retrieve sensitive information or modify data.
The web server responds to the attacker's request, potentially disclosing sensitive database content (e.g., user credentials, system configurations, application data) within the HTTP response body.
The attacker parses the HTTP response to extract the compromised data, achieve data exfiltration, or modify database records.

Impact

Successful exploitation of CVE-2026-14641 can lead to significant data breaches, where attackers can read, modify, or delete sensitive information stored in the application's database. This includes user accounts, academic records, scheduling data, and potentially administrative credentials. While specific victim counts are not available, the widespread use of SourceCodester systems in educational settings suggests that successful attacks could impact student and staff privacy, disrupt academic operations, and lead to reputational damage for affected institutions. The CVSS 3.1 score of 7.3 (High) indicates low impact on confidentiality, integrity, and availability, but SQL injection commonly leads to more severe consequences like full database compromise or even arbitrary code execution under certain configurations.

Recommendation

Prioritize patching SourceCodester Class and Exam Timetabling System to a non-vulnerable version immediately to address CVE-2026-14641.
Deploy the provided Sigma rule to your SIEM solution to detect exploitation attempts against the /edit_course.php endpoint.
Ensure webserver logging (category: webserver) is enabled and configured to capture full HTTP request details, especially cs-uri-stem and cs-uri-query, to enable the rule.
Implement web application firewalls (WAFs) with rules designed to detect and block SQL injection payloads targeting HTTP GET parameters.