EUVD-2026-41742
GHSA-2qwv-jcxq-whfc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible PHP endpoint, no auth required, no interaction; low C/I/A reflects data-layer SQL injection without evidence of full system compromise or scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_product.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
AnalysisAI
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the application's database to remote, unauthenticated attackers through the unsanitized ID parameter in /edit_product.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote access with no prerequisites, yielding low-rated but real confidentiality, integrity, and availability impact against the underlying database. No public exploit identified at time of analysis is contradicted by the description and E:P supplemental metric - a public exploit exists, elevating the practical risk above what the 5.5 base score alone suggests for any internet-exposed instance.
Technical ContextAI
The affected application is a PHP-based academic scheduling tool distributed by SourceCodester, a platform offering open-source demo scripts primarily for educational use. The vulnerability resides in /edit_product.php, where the ID parameter is passed directly into a SQL query without sanitization or parameterization. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), the parent class that encompasses SQL injection (CWE-89). This pattern - unparameterized user-supplied identifiers in PHP/MySQL CRUD scripts - is endemic to SourceCodester applications. No CPE strings were provided, but the affected product is version 1.0 of the Class and Exam Timetabling System.
RemediationAI
No vendor-released patch has been identified at time of analysis. SourceCodester does not maintain a formal security advisory program, and no patched version is referenced in any available source. The primary fix is to replace direct string concatenation in SQL queries within /edit_product.php with parameterized queries or prepared statements using PHP's PDO or MySQLi extensions - this eliminates the injection root cause with no functional side effects. As an immediate compensating control, restrict network access to /edit_product.php via web server access controls (e.g., Apache .htaccess IP allowlist or nginx location block) to limit exposure to trusted internal networks only, noting that this prevents legitimate remote use of the feature. Additionally, deploying a Web Application Firewall rule to block SQLi patterns against this endpoint reduces opportunistic exploitation risk. If this system is deployed in a production environment, assess whether it should be replaced with a maintained alternative, given SourceCodester's lack of security patch cadence.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today