CVE-2026-13521: Class & Exam Timetabling SQL Injection

CVE-2026-13521 Overview

CVE-2026-13521 is a SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System version 1.0. The flaw resides in the /preview5.php script, where the course_year_section parameter is passed to a database query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements. A public exploit is available, increasing the likelihood of opportunistic scanning and abuse. The vulnerability is tracked under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL against the backend database, potentially exposing scheduling records, user data, and administrative credentials stored by the application.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Vulnerable component: /preview5.php
Affected parameter: course_year_section

Discovery Timeline

2026-06-29 - CVE-2026-13521 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13521

Vulnerability Analysis

The vulnerability exists in the /preview5.php file of the Class and Exam Timetabling System. The course_year_section argument is embedded directly into a SQL query executed against the backend database. Because the parameter is not validated, escaped, or bound as a prepared statement, an attacker can append or modify SQL clauses through crafted HTTP requests.

Successful exploitation allows extraction of database contents, including timetable records, user accounts, and password hashes. Depending on database privileges, an attacker may also modify or delete records, or pivot toward file read and write primitives via database functions. The attack is remote, requires no authentication, and no user interaction. See the VulDB entry for CVE-2026-13521 and the GitHub issue discussion for additional context.

Root Cause

The root cause is missing input neutralization on the course_year_section request parameter before concatenation into a SQL statement. The application relies on direct string interpolation instead of parameterized queries, which allows attacker-controlled SQL syntax to reach the database engine.

Attack Vector

The attack vector is network-based. An attacker sends an HTTP request to /preview5.php with a malicious payload in the course_year_section parameter. Typical payloads use UNION SELECT, boolean-based blind logic, or time-based delays to enumerate schemas and exfiltrate data. No credentials or user interaction are required.

No verified proof-of-concept code is republished here. Refer to the VulDB vulnerability detail page for technical breakdowns.

Detection Methods for CVE-2026-13521

Indicators of Compromise

HTTP requests to /preview5.php containing SQL metacharacters such as single quotes, UNION, SLEEP(, --, or /* in the course_year_section parameter.
Anomalous database errors or long response times originating from the timetabling application logs.
Outbound connections from the web server to unexpected hosts following requests to /preview5.php.

Detection Strategies

Deploy web application firewall rules that inspect the course_year_section parameter for SQL syntax and known injection patterns.
Enable database query logging and alert on queries generated by /preview5.php that contain UNION, INFORMATION_SCHEMA, or stacked statements.
Correlate access logs against source IPs producing high error rates or repeated requests with parameter mutations.

Monitoring Recommendations

Baseline normal request patterns to /preview5.php and alert on deviations in parameter length or entropy.
Monitor for database user activity spikes, especially SELECT volume against user or authentication tables.
Forward web server and database logs to a centralized analytics platform for retrospective hunting.

How to Mitigate CVE-2026-13521

Immediate Actions Required

Restrict public access to /preview5.php at the network or reverse-proxy layer until a fix is applied.
Rewrite the affected query using prepared statements with bound parameters via PDO or mysqli.
Apply server-side input validation to enforce an allow-list format for course_year_section values.
Rotate database credentials and audit database contents if exploitation is suspected.

Patch Information

No official vendor patch has been published for the SourceCodester Class and Exam Timetabling System 1.0 at the time of NVD publication. Administrators should monitor the SourceCodester project page and the VulDB tracking entry for remediation updates.

Workarounds

Place the application behind a web application firewall with SQL injection signatures enabled.
Enforce least-privilege database accounts so the web application cannot access unrelated schemas or execute administrative functions.
Disable or remove the /preview5.php endpoint if it is not required for production operations.

bash

# Example nginx block to restrict access to the vulnerable endpoint
location = /preview5.php {
    allow 10.0.0.0/8;
    deny all;
}