CVE-2026-13486: Class and Exam Timetabling SQLi Flaw

CVE-2026-13486 Overview

CVE-2026-13486 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /preview6.php script, where the course_year_section parameter is passed to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is exploitable remotely without authentication or user interaction. Public disclosure of the exploit details has occurred, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote unauthenticated attackers can inject SQL through the course_year_section argument to read, modify, or corrupt data in the backing database.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
/preview6.php component
Deployments exposing the application over HTTP/HTTPS

Discovery Timeline

2026-06-28 - CVE-2026-13486 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13486

Vulnerability Analysis

The vulnerability exists in the /preview6.php endpoint of the Class and Exam Timetabling System. The course_year_section HTTP parameter is concatenated directly into a SQL query issued against the application database. Because the input is neither parameterized nor escaped, an attacker can terminate the intended query context and append arbitrary SQL syntax. Exploitation requires only network access to the web application, with no credentials or user interaction. Successful attacks can lead to unauthorized reading of timetable data, student records, and administrative content, along with modification or deletion of records. The EPSS score of 0.412% (percentile 33.1) reflects moderate near-term exploitation likelihood given the public disclosure.

Root Cause

The root cause is improper neutralization of special elements in a SQL statement [CWE-74]. /preview6.php accepts the course_year_section argument and interpolates it into a query string without prepared statements or input validation. Any metacharacters supplied by the client become part of the executed SQL.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to /preview6.php with a malicious course_year_section value containing SQL syntax such as boolean expressions, UNION SELECT clauses, or time-based payloads. The manipulated query executes with the privileges of the application's database user. Because the exploit has been publicly disclosed, automated scanners and opportunistic attackers may weaponize it against internet-exposed instances. See the VulDB entry for CVE-2026-13486 and the GitHub Issue Discussion for additional technical context.

Detection Methods for CVE-2026-13486

Indicators of Compromise

HTTP requests targeting /preview6.php with SQL metacharacters (', ", --, ;, /*) in the course_year_section parameter.
Access log entries containing SQL keywords such as UNION, SELECT, SLEEP(, or BENCHMARK( in query strings.
Unusual database errors or extended response times originating from requests to /preview6.php.
Repeated requests from a single source enumerating tables, columns, or database schema information.

Detection Strategies

Deploy signature-based Web Application Firewall (WAF) rules that inspect the course_year_section parameter for SQL injection patterns.
Enable database query logging and alert on anomalous query structures such as tautologies (OR 1=1) or stacked queries.
Correlate web server access logs with database audit logs to identify injection attempts that reach the backend.

Monitoring Recommendations

Baseline normal request patterns to /preview6.php and alert on deviations in parameter length, character distribution, or request rate.
Monitor outbound database traffic for schema enumeration queries against information_schema tables.
Track HTTP 500 responses from /preview6.php as potential signals of failed injection attempts.

How to Mitigate CVE-2026-13486

Immediate Actions Required

Restrict network exposure of the Class and Exam Timetabling System to trusted networks or VPN access until a fix is available.
Deploy WAF rules to block SQL injection payloads targeting /preview6.php and the course_year_section parameter.
Audit the application database user's privileges and remove any unnecessary DROP, ALTER, or FILE permissions.
Review web and database logs for prior exploitation attempts against the affected endpoint.

Patch Information

No vendor patch has been referenced in the CVE record. SourceCodester has not published a fixed release for the Class and Exam Timetabling System 1.0 at the time of publication. Operators should monitor the SourceCodester website and the VulDB advisory for updates. Until an official patch is released, apply the workarounds below and consider code-level remediation by replacing string concatenation with parameterized queries in /preview6.php.

Workarounds

Modify /preview6.php to use prepared statements with bound parameters for the course_year_section value.
Apply server-side input validation to reject non-alphanumeric characters in the course_year_section argument.
Enforce least-privilege database credentials so the application account cannot execute administrative SQL commands.
Place the application behind an authenticating reverse proxy to eliminate unauthenticated exposure.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on the vulnerable parameter
SecRule ARGS:course_year_section "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--|;|/\*|\bor\b\s+\d+=\d+)" \
  "id:1013486,phase:2,deny,status:403,log,msg:'CVE-2026-13486 SQLi attempt on /preview6.php'"