EUVD-2026-41785
GHSA-8mwx-j7wq-wqcc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated SQL injection with low confidentiality, integrity, and availability impact; no scope change since injection is contained to the application database.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The impacted element is an unknown function of the file /edit_course1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_course1.php endpoint to remote, unauthenticated database manipulation via an unsanitized ID parameter. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication is required and the attack is trivially executable over the network. Exploit code has been publicly disclosed per VulDB submission and a GitHub issue report, with the E:P modifier in the CVSS 4.0 vector corroborating proof-of-concept availability - though no CISA KEV listing indicates confirmed active exploitation at time of analysis.
Technical ContextAI
The affected product is a PHP-based academic scheduling web application distributed by SourceCodester, version 1.0. The root cause is classified under CWE-74 (Injection), the parent class encompassing SQL injection - meaning user-supplied input reaches a database query interpreter without adequate sanitization or parameterization. Specifically, the ID argument passed to /edit_course1.php is incorporated into a backend SQL query without escaping, allowing an attacker to alter query logic. PHP applications on shared hosting or LAMP stacks frequently suffer this class of vulnerability when developers concatenate user input directly into query strings rather than using prepared statements with bound parameters. No CPE strings were provided in the input data.
RemediationAI
No vendor-released patch or fixed version has been identified at the time of analysis; no vendor advisory was located in the provided references. The primary remediation is to replace direct string concatenation in the ID parameter query with parameterized statements or prepared queries in the PHP source code, eliminating the injection surface entirely. As an immediate compensating control, operators should restrict access to /edit_course1.php via web server configuration (e.g., IP allowlist or authentication gateway), accepting the trade-off of reduced accessibility. A web application firewall rule blocking common SQL injection patterns (UNION SELECT, OR 1=1, quote characters in numeric parameters) can reduce automated exploitation risk but is bypassable by a motivated attacker and should not be treated as a permanent fix. The VulDB report is available at https://vuldb.com/vuln/376362 and the public disclosure at https://github.com/orionyan520/cve_report/issues/1.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today