Timetabling System CVE-2026-13485

No authentication is required and no special configuration is needed - exploitation targets the default deployed state of the application (CVSS PR:N, UI:N, AC:L, AT:N). The sole prerequisite is network accessibility to the /preview.php endpoint with the course_year_section parameter accepted. Exploitation impact is practically limited by the database account's privilege level: if the application connects to the database with a least-privilege account scoped to SELECT/INSERT on the timetabling schema, full database compromise (e.g., reading other schemas, executing OS commands via xp_cmdshell) is not possible. The software's educational/demo nature means it is unlikely to be deployed behind robust network controls, but that assessment is environmental rather than a technical condition of the vulnerability itself.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) represents a worst-case accessibility profile: network-reachable, zero authentication, no user interaction, and no special preconditions. However, the impact metrics (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N) constrain the severity - this is not a full remote code execution or complete database takeover scenario under a least-privilege database configuration. The E:P modifier confirms publicly available exploit code (GitHub POC at lffaker/cybersec issue #6), raising practical risk above the 5.5 base score. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, meaning active exploitation has not been officially confirmed. The most significant risk dampener is prevalence: SourceCodester applications are educational/demo software with negligible enterprise deployment footprint. Real-world attack surface is narrow even though the technical exploitation path is straightforward.

An unauthenticated remote attacker sends a crafted HTTP GET or POST request to /preview.php with a SQL injection payload in the course_year_section parameter (e.g., appending ' OR '1'='1 or a UNION-based extraction query). Because a public POC exists on GitHub (https://github.com/lffaker/cybersec/issues/6), this attack is accessible to low-skill adversaries. Depending on the database user's privileges, the attacker may enumerate table contents, extract credentials or academic records, or modify timetabling data.