SourceCodester Timetabling System: Batch of 10 SQLi and Auth Bypass Flaws Disclosed
Key findings • Ten vulnerabilities disclosed for SourceCodester Class and Exam Timetabling System 1.0 between Sept 4-6, 2026. • Nine SQL injection flaws found across multiple administrative a…
Key findings
- Ten vulnerabilities disclosed for SourceCodester Class and Exam Timetabling System 1.0 between Sept 4-6, 2026.
- Nine SQL injection flaws found across multiple administrative and user management files.
- One missing authorization vulnerability in
/admin/session.php. - All vulnerabilities have a High severity (CVSSv3 7.3) and publicly disclosed exploits.
- Affected files include those for adding rooms, products, courses, and deleting user accounts.
On September 6, 2026, a batch of ten vulnerabilities was disclosed for the SourceCodester Class and Exam Timetabling System version 1.0. The majority of these flaws, nine in total, are SQL injection vulnerabilities, with one additional vulnerability related to missing authorization. These vulnerabilities, with a CVSSv3 score of 7.3 (High), were disclosed by multiple sources over a two-day period, from September 4th to September 6th, 2026. The widespread nature of these SQL injection flaws across various administrative and user management files indicates a systemic issue within the system's handling of user inputs.
The SQL injection vulnerabilities are concentrated in several administrative files, including those for adding rooms, products, and courses. Specifically, CVE-2026-86225 in /admin/modal_add_room.php, CVE-2026-86224 in /admin/modal_add_product.php, CVE-2026-86223 in /admin/modal_add_coursea.php, CVE-2026-86222 in /admin/modal_add_course2.php, CVE-2026-86221 in /admin/modal_add_course1.php, and CVE-2026-86220 in /admin/modal_add_course.php all stem from the manipulation of arguments like room_name and course within the mysqli_query function, leading to SQL injection.
Further SQL injection vulnerabilities were found in user management functionalities. CVE-2026-86210 in delete_user_account.php, CVE-2026-86209 in delete_user.php, and CVE-2026-86208 in delete_teacher.php all exploit the ID argument to achieve SQL injection. These vulnerabilities highlight a critical weakness in how the system processes identifiers for deletion operations.
The tenth vulnerability, CVE-2026-85512, disclosed on September 4th, 2026, affects /admin/session.php. This flaw involves the manipulation of the ID argument and results in a missing authorization vulnerability, allowing remote attackers to bypass access controls.
All disclosed vulnerabilities in this batch are described as remotely executable and have had their exploits publicly disclosed, increasing the risk for any unpatched systems. The consistent CVSSv3 score of 7.3 across most of these high-severity flaws underscores the significant risk posed by this batch of vulnerabilities. Users of the SourceCodester Class and Exam Timetabling System are strongly advised to investigate and apply any available patches or mitigations immediately to protect their systems from potential exploitation.
The consistent pattern of SQL injection vulnerabilities across multiple files, particularly in administrative functions, suggests a need for a thorough security audit of the SourceCodester Class and Exam Timetabling System. The public disclosure of exploits for all these vulnerabilities means that systems running unpatched versions are at immediate risk. Organizations using this system should prioritize updating to the latest available version or implementing specific security controls to mitigate these risks. The missing authorization vulnerability in session.php adds another layer of concern, potentially allowing unauthorized access to sensitive system functions. This batch of disclosures serves as a critical reminder for users to stay vigilant about security updates and advisories for their software.