CVE-2026-13485: Class and Exam Timetabling SQL Injection

CVE-2026-13485 Overview

CVE-2026-13485 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /preview.php script, where the course_year_section parameter is passed directly into a database query without proper sanitization. Attackers can manipulate this argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable over the network without authentication or user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The issue is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL queries through /preview.php to read, modify, or delete database contents in the Class and Exam Timetabling System.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Deployments exposing /preview.php to untrusted networks
Downstream forks or derivative projects reusing the vulnerable query logic

Discovery Timeline

2026-06-28 - CVE-2026-13485 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13485

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the /preview.php endpoint of the Class and Exam Timetabling System. The course_year_section HTTP argument is concatenated into an SQL statement without parameterization or input filtering. Attackers submit crafted values containing SQL metacharacters to alter the intended query structure. Successful exploitation exposes timetable, user, and course records stored in the backend database.

Because the endpoint is reachable remotely and no authentication is enforced, exploitation requires only network access to the web server. Publicly available exploit details lower the technical barrier for attackers to weaponize the flaw against exposed instances.

Root Cause

The root cause is improper neutralization of user-controlled input before it reaches the database layer. Rather than using prepared statements or bound parameters, the application concatenates the raw course_year_section value into an SQL query string. This design pattern lets attacker-supplied syntax break out of the intended value context and execute additional SQL.

Attack Vector

An attacker sends an HTTP request to /preview.php with a malicious payload in the course_year_section parameter. Typical payloads include boolean-based, union-based, or time-based injection strings that either extract data or infer database contents from response behavior. No credentials, cookies, or prior privileges are required. See the GitHub Issue Discussion and VulDB Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-13485

Indicators of Compromise

HTTP requests to /preview.php containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP( in the course_year_section parameter
Unusual database error messages or unexpected response sizes returned from /preview.php
Spikes in outbound queries from the web application service account to sensitive database tables
Web server access logs showing repeated course_year_section values from a single source over short intervals

Detection Strategies

Deploy web application firewall (WAF) rules that inspect course_year_section values for SQL syntax and block anomalous payloads
Enable database query logging and alert on queries originating from preview.php that contain UNION, INFORMATION_SCHEMA, or benchmark functions
Correlate web access logs with database audit logs to identify injection attempts that reach the data layer

Monitoring Recommendations

Monitor authentication and privilege changes on the timetabling database for signs of tampering
Track error rates and response time anomalies on /preview.php to detect blind injection probing
Alert on new outbound connections from the database host, which may indicate post-exploitation data exfiltration

How to Mitigate CVE-2026-13485

Immediate Actions Required

Restrict access to /preview.php to trusted networks or authenticated users through network ACLs or reverse proxy rules
Deploy WAF signatures that block SQL injection patterns targeting the course_year_section parameter
Review database and web server logs for prior exploitation attempts and rotate credentials if compromise is suspected

Patch Information

No official vendor patch has been published for CVE-2026-13485 at the time of writing. Administrators should monitor the SourceCodester Security Resources page for updates and consult the VulDB CVE Details entry for tracking. Until a fix is released, apply the workarounds below and consider retiring the application if it is used in production.

Workarounds

Modify /preview.php to use parameterized queries or prepared statements for all references to course_year_section
Apply strict server-side input validation, allowing only expected character sets such as alphanumerics and hyphens
Enforce least-privilege database accounts so the web application cannot read or alter tables beyond its functional scope
Take the application offline if it is internet-facing and not required for business operations

bash

# Example: nginx location block restricting /preview.php to an internal subnet
location = /preview.php {
    allow 10.0.0.0/8;
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}