CVE-2026-11483: Class & Exam Timetabling SQLi Flaw

CVE-2026-11483 Overview

CVE-2026-11483 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /archive4.php script, where the sy request parameter is concatenated into a database query without sanitization. Remote attackers can issue crafted HTTP requests to manipulate the underlying SQL statement, leak data, or alter records. No authentication or user interaction is required to trigger the issue. The exploit has been disclosed publicly, increasing the likelihood of opportunistic abuse against exposed installations. The weakness maps to [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL through the sy parameter of /archive4.php, exposing or modifying timetable, user, and credential data stored in the application database.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
The vulnerable component is /archive4.php shipped with the application
Deployments exposing the PHP application directly to untrusted networks

Discovery Timeline

2026-06-08 - CVE-2026-11483 published to the National Vulnerability Database
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11483

Vulnerability Analysis

The vulnerability is a classic SQL injection in a PHP web application. The /archive4.php endpoint accepts the sy parameter from the HTTP request and embeds the value directly into a SQL query string. Because the parameter is neither escaped nor bound through a prepared statement, attackers can append SQL operators, UNION clauses, or stacked subqueries that the database executes as part of the original statement.

The attack surface is remote and unauthenticated. An attacker can supply a payload over the network using a standard HTTP client. Exploitation enables data exfiltration through UNION-based or boolean-based techniques, and may permit write operations depending on the privileges of the database user that the application uses to connect.

The vendor record contains no patched version, so all current 1.0 installations should be assumed vulnerable. A public exploit reference is tracked in the GitHub CVE Issue Discussion and aggregated in VulDB CVE-2026-11483.

Root Cause

The root cause is improper neutralization of input ([CWE-74]). The sy parameter flows from a superglobal such as $_GET or $_POST directly into a SQL query without parameterization, type casting, or whitelist validation. Any character — including single quotes, semicolons, and SQL keywords — reaches the database driver intact.

Attack Vector

The attack vector is network-based with low attack complexity. An attacker sends a single HTTP request to /archive4.php with a malicious sy value. The server-side PHP interpolates the value into the SQL query and the database executes the modified statement. No credentials, prior session, or user interaction are needed, making automated scanning and mass exploitation feasible.

The vulnerability is described in the public references rather than demonstrated with verified code in this advisory. Practitioners can review the VulDB Vulnerability #369103 entry for additional technical context on the injection point.

Detection Methods for CVE-2026-11483

Indicators of Compromise

HTTP requests to /archive4.php containing SQL metacharacters in the sy parameter, such as ', --, UNION SELECT, SLEEP(, or INFORMATION_SCHEMA.
Web server access logs showing repeated GET or POST requests to /archive4.php from a single source with varying sy values, indicative of automated injection tooling.
Database error messages referencing syntax errors near values originating from sy in PHP error logs.
Unexpected SELECT queries against information_schema.tables, users, or credential tables originating from the application database account.

Detection Strategies

Deploy a web application firewall (WAF) signature that matches SQL keywords and tautologies inside the sy parameter of /archive4.php.
Enable database query logging and alert on statements containing UNION clauses or subqueries that did not exist in the baseline application traffic.
Run authenticated vulnerability scans, such as sqlmap, against staging copies of the application to confirm the injection point and validate detections.

Monitoring Recommendations

Forward web server, PHP error, and database audit logs to a centralized analytics platform for correlation across request, application, and query layers.
Track HTTP 500 responses from /archive4.php as a leading indicator of injection probes that trigger SQL syntax errors.
Monitor outbound database connections and row counts for anomalous volume that may signal data exfiltration following successful injection.

How to Mitigate CVE-2026-11483

Immediate Actions Required

Restrict access to /archive4.php through network controls or authentication until a code-level fix is applied.
Deploy WAF rules that block SQL injection payloads targeting the sy parameter.
Rotate database credentials used by the application and reduce the database account to the minimum privileges required.
Review web server and database logs for prior exploitation attempts referenced in the Indicators of Compromise section.

Patch Information

No official vendor patch is referenced in the NVD record at the time of publication. Administrators should monitor the SourceCodester Blog Post channel and the VulDB CVE-2026-11483 entry for updates. In the absence of a vendor fix, modify /archive4.php locally to use parameterized queries through PDO or MySQLi prepared statements, and validate that sy matches an expected format such as a numeric academic year.

Workarounds

Place the application behind an authenticating reverse proxy so that unauthenticated internet users cannot reach /archive4.php.
Add input validation in PHP that rejects any sy value not matching a strict allowlist regular expression before the value reaches the SQL layer.
Configure the database user with SELECT-only privileges on required tables to limit the impact of injection to read operations.
Disable verbose database error messages in PHP (display_errors = Off) to reduce information leakage to attackers performing error-based injection.

bash

# Example php.ini hardening to suppress error-based injection feedback
display_errors = Off
log_errors = On
error_log = /var/log/php/error.log