Is there a public PoC exploit available for CVE-2026-13488?

Yes, a public proof-of-concept exploit is available for CVE-2026-13488. Prioritise patching immediately. EPSS: 0.3%.

Timetabling System CVE-2026-13488

Q: What is the CVSS score of CVE-2026-13488?

CVE-2026-13488 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39988 MEDIUM

SQL Injection (CWE-89)

2026-06-28 VulDB

GHSA-6j43-r7wj-rqwv

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable unauthenticated endpoint with no complexity; partial C/I/A reflects typical SQLi impact without confirmed DBA-level privileges enabling full compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 28, 2026 - 11:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 28, 2026 - 11:15 vuln.today

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/7.php. Affected by this vulnerability is an unknown functionality of the file /preview7.php. The manipulation of the argument course_year_section results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /preview7.php endpoint to unauthenticated remote exploitation via unsanitized input in the course_year_section parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote exploitation with no authentication or user interaction required. No public exploit identified at time of analysis is incorrect here - a publicly available exploit exists (GitHub issue referenced in references), elevating urgency despite the absence of a CISA KEV listing.

Technical ContextAI

The affected product is a PHP-based academic scheduling web application distributed by SourceCodester, a platform known for publishing hobbyist and educational source code (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the course_year_section parameter passed to /preview7.php is directly interpolated into a backend SQL query without parameterization or sanitization. This is a classic first-generation PHP vulnerability pattern where user-supplied GET or POST input is concatenated into raw SQL, enabling attackers to alter query logic, extract schema data, dump table contents, or - depending on database permissions - write files or execute OS commands via stacked queries or INTO OUTFILE.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary fix is to rewrite the database query in /preview7.php to use prepared statements with parameterized inputs (e.g., PDO or MySQLi with bound parameters), ensuring course_year_section is never concatenated directly into SQL. As an interim compensating control, implement server-side input validation to allowlist expected values for course_year_section (e.g., alphanumeric and dash characters only) and reject all other input with a 400 response - this reduces attack surface but is not a substitute for parameterization. Deploying a web application firewall (WAF) rule to detect and block SQL injection patterns targeting this parameter can provide detection and limited blocking capability, though WAF bypass techniques exist. Restricting network access to the application to trusted internal networks eliminates remote exploitation entirely if public exposure is not required. Given that SourceCodester software is often deployed without ongoing vendor support, organizations should evaluate whether this application can be retired or replaced. Reference: https://vuldb.com/vuln/374485, exploit reference: https://github.com/yan-124/yan/issues/4.