CVE-2026-11484: SourceCodester Timetabling SQLi Flaw

CVE-2026-11484 Overview

CVE-2026-11484 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /archive3.php script, where the sy parameter is passed to a database query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements. Public exploit details are available, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL through the sy parameter of /archive3.php, enabling unauthorized read, modification, or extraction of database contents.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Vulnerable endpoint: /archive3.php
Vulnerable parameter: sy

Discovery Timeline

2026-06-08 - CVE-2026-11484 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11484

Vulnerability Analysis

The vulnerability affects the archive3.php script of the Class and Exam Timetabling System, a PHP-based scheduling application. The sy query parameter is concatenated directly into a backend SQL statement without parameterized queries or input validation. An attacker supplies crafted SQL syntax through this parameter and the database engine executes it as part of the query.

The attack is network-reachable and does not require authentication or user interaction. Because the affected file appears to handle archived schedule records, an attacker can read sensitive data, alter records, or enumerate the database schema. The exploit has been disclosed publicly, lowering the skill threshold for attackers.

Root Cause

The root cause is improper neutralization of special characters in a downstream SQL query [CWE-74]. The sy parameter, supplied through an HTTP GET or POST request, is interpolated into a SQL string without using prepared statements or escaping functions such as mysqli_real_escape_string(). This allows attacker-controlled SQL fragments to break out of the intended query context.

Attack Vector

The attack vector is remote and unauthenticated over HTTP/HTTPS. An attacker issues a request to /archive3.php with a malicious value in the sy parameter. Typical payloads use UNION-based, boolean-based, or time-based blind SQL injection techniques to extract data or confirm exploitability. Verified proof-of-concept details are referenced in the GitHub Issue Discussion and the VulDB CVE-2026-11484 entry.

No verified code examples are available. Refer to the public references for technical exploitation details.

Detection Methods for CVE-2026-11484

Indicators of Compromise

HTTP requests to /archive3.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, --, or /* inside the sy parameter.
Web server access logs showing repeated requests to /archive3.php from a single source with varying sy values.
Database error messages (such as MySQL syntax errors) returned in HTTP responses from the application.
Unexpected long response times for /archive3.php requests, indicating time-based blind injection probes.

Detection Strategies

Inspect web server and application logs for non-numeric or encoded payloads in the sy parameter of /archive3.php.
Deploy a Web Application Firewall (WAF) with SQL injection signatures and review blocked events for this specific endpoint.
Enable database query logging and alert on queries originating from the timetabling application that contain unusual OR, UNION, or comment sequences.
Run authenticated dynamic application security testing (DAST) against the application to confirm exposure.

Monitoring Recommendations

Forward web server, WAF, and database logs to a centralized analytics platform for correlation and retention.
Establish alerting on spikes in HTTP 500 errors or query parse errors tied to /archive3.php.
Track outbound connections from the database host to flag potential data exfiltration following successful injection.

How to Mitigate CVE-2026-11484

Immediate Actions Required

Restrict network access to the Class and Exam Timetabling System to trusted users or internal networks until a fix is applied.
Place the application behind a WAF and enable SQL injection protection rules for the sy parameter on /archive3.php.
Audit database accounts used by the application and reduce privileges to the minimum required for normal operation.
Review application and database logs for prior exploitation attempts dating back to the application's deployment.

Patch Information

At the time of publication, no official vendor patch has been referenced in the NVD entry. Consult the SourceCodester Resource Page and the VulDB Vulnerability #369104 entry for any subsequent fix release. If no patch is available, apply the source-level fix described below.

Workarounds

Modify archive3.php to use parameterized queries via mysqli prepared statements or PDO with bound parameters instead of string concatenation.
Validate the sy parameter against an allowlist (for example, a strict regular expression matching only the expected school-year format).
Apply server-side input sanitization using mysqli_real_escape_string() as a defense-in-depth control when prepared statements cannot be used immediately.
Disable or remove the /archive3.php endpoint if it is not required for production operations.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns in the 'sy' parameter
SecRule ARGS:sy "@rx (?i)(union(\s|\+)+select|sleep\s*\(|--|/\*|';)" \
    "id:1026114840,phase:2,deny,status:403,log,\
    msg:'CVE-2026-11484 SQLi attempt against /archive3.php sy parameter'"