CVE-2026-13487: Class Timetabling System SQLi Flaw

CVE-2026-13487 Overview

CVE-2026-13487 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /archive.php script, where the sy parameter is passed to a database query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability requires no authentication and no user interaction. A public exploit disclosure exists, increasing the likelihood of opportunistic scanning and exploitation against exposed instances. The weakness maps to [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Unauthenticated remote attackers can inject SQL through the sy parameter of /archive.php, exposing database contents and enabling record tampering.

Affected Products

• SourceCodester Class and Exam Timetabling System 1.0
• Deployments exposing /archive.php to untrusted networks
• Downstream forks or bundles that reuse the vulnerable archive handler

Discovery Timeline

• 2026-06-28 - CVE-2026-13487 published to the National Vulnerability Database (NVD)
• 2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13487

Vulnerability Analysis

The vulnerability is a classic SQL injection in the sy request parameter processed by /archive.php. The application concatenates the attacker-controlled value directly into a SQL statement executed against the backend database. Because the endpoint accepts requests over the network without authentication, an attacker only needs reachability to the web application to exploit the flaw. Successful exploitation can lead to disclosure of stored records, modification of timetable data, and potential lateral movement within the database. Public exploit documentation lowers the barrier for reuse by low-skill actors.

Root Cause

The root cause is missing input neutralization on the sy HTTP parameter before it reaches the SQL query layer. The affected code path does not use parameterized queries or prepared statements, and it does not apply an allowlist for permitted characters or values. As a result, SQL metacharacters submitted by the client alter the query structure.

Attack Vector

An attacker sends a crafted HTTP request to /archive.php with a malicious value in the sy parameter. Injected payloads can use UNION SELECT, boolean-based blind techniques, or time-based techniques depending on the database backend. No credentials, tokens, or prior session state are required. Refer to the VulDB Vulnerability Details and GitHub Issue Discussion for reproduction context.

No verified exploit code is republished here. The vulnerability manifests when /archive.php?sy=<payload> is submitted and the server-side handler embeds the value into a SQL statement without parameterization.

Detection Methods for CVE-2026-13487

Indicators of Compromise

• HTTP requests to /archive.php containing SQL metacharacters such as single quotes, UNION, SLEEP(, --, or /* in the sy parameter.
• Web server logs showing repeated sy= values with encoded payloads or unusually long strings.
• Database error messages surfaced in HTTP responses referencing MySQL syntax errors originating from the archive query.

Detection Strategies

• Deploy Web Application Firewall (WAF) rules that inspect the sy query string on /archive.php for SQL syntax tokens.
• Enable database query logging and alert on queries executed by the application user that contain concatenated user input patterns.
• Correlate spikes in 500-series HTTP responses from /archive.php with client IPs performing parameter fuzzing.

Monitoring Recommendations

• Monitor outbound database traffic for unusual SELECT volumes from the timetabling application user.
• Track authentication events on the database to detect follow-on credential abuse after data exfiltration.
• Retain web access logs for /archive.php for at least 90 days to support incident review.

How to Mitigate CVE-2026-13487

Immediate Actions Required

• Restrict network access to the Class and Exam Timetabling System to trusted networks or VPN users until a fix is applied.
• Add a WAF or reverse proxy rule that blocks requests to /archive.php containing SQL syntax in the sy parameter.
• Review database logs for signs of prior exploitation and rotate any credentials the application may have exposed.

Patch Information

No vendor patch has been published in the referenced advisories. Review the VulDB CVE Record and the SourceCodester Resource Hub for future updates. In the absence of an official fix, apply a source-level correction by replacing string concatenation in /archive.php with prepared statements using bound parameters, and validate that sy matches an expected format such as a school-year identifier.

Workarounds

• Implement server-side input validation that restricts sy to a numeric or fixed-format value before it reaches the query layer.
• Run the application database account with least privilege, removing rights to modify schema or read unrelated tables.
• Disable public exposure of /archive.php via web server rewrite rules if the archive feature is not required.

# Example nginx rule to block SQL metacharacters in the sy parameter
location = /archive.php {
    if ($arg_sy ~* "('|\"|--|;|/\*|union|select|sleep\(|benchmark\()") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}