CVE-2026-13526: Class & Exam Timetabling SQLi Flaw

CVE-2026-13526 Overview

CVE-2026-13526 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_class.php script, where the ID parameter is passed to a backend database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is remotely exploitable over the network and requires no authentication or user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against exposed instances. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL statements through the ID parameter of /edit_class.php, exposing database contents and integrity.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
The /edit_class.php endpoint
Deployments exposing the affected script to untrusted networks

Discovery Timeline

2026-06-29 - CVE-2026-13526 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13526

Vulnerability Analysis

The vulnerability affects the class-editing workflow in the Class and Exam Timetabling System. When a user accesses /edit_class.php, the application reads the ID parameter directly from the HTTP request and embeds it into a SQL query. Because the value is not validated, escaped, or bound as a parameter, an attacker can append additional SQL clauses. Successful exploitation lets the attacker read arbitrary database rows, modify records, or enumerate the schema. According to public disclosure sources including the GitHub Issue Report and the VulDB Vulnerability Details, the exploit has been published. The application appears to be deployed by educational institutions to manage class and exam scheduling, making the exposed dataset sensitive.

Root Cause

The root cause is missing input sanitization and the absence of parameterized queries in /edit_class.php. The ID argument is concatenated into a SQL statement instead of being bound as a prepared statement variable. This design defect maps to [CWE-74], improper neutralization of special elements in downstream components.

Attack Vector

Attackers deliver a crafted HTTP request to /edit_class.php with a malicious ID value containing SQL metacharacters such as single quotes, UNION SELECT clauses, or boolean-based payloads. No credentials or user interaction are required. Because the endpoint is reachable over the network, exploitation can be automated with commodity SQL injection tooling.

No verified proof-of-concept code is included here. Refer to the VulDB CVE Entry for public exploitation details.

Detection Methods for CVE-2026-13526

Indicators of Compromise

HTTP requests to /edit_class.php containing SQL metacharacters in the ID parameter, such as single quotes, --, UNION, SLEEP(, or OR 1=1.
Unusual database error messages logged by the web server or PHP error log referencing edit_class.php.
Outbound database queries returning abnormally large result sets tied to timetabling tables.

Detection Strategies

Enable verbose access logging on the web server and alert on non-numeric values in the ID query string.
Deploy a web application firewall (WAF) with SQL injection signatures tuned for URI path /edit_class.php.
Correlate web access logs with database audit logs to identify anomalous query patterns originating from the timetabling application.

Monitoring Recommendations

Monitor authentication-free endpoints of the timetabling system for repeated requests from a single IP with varying ID payloads.
Track database error rates and slow-query counts, which often spike during blind or time-based SQL injection probing.
Alert on unexpected INFORMATION_SCHEMA reads or full-table dumps from the application service account.

How to Mitigate CVE-2026-13526

Immediate Actions Required

Restrict network access to the Class and Exam Timetabling System until a code-level fix is applied, using firewall rules or VPN gating.
Place a WAF in front of /edit_class.php with rules that block SQL metacharacters in the ID parameter.
Review web and database logs for prior exploitation attempts against the affected endpoint.

Patch Information

No official vendor patch has been published at the time of writing. SourceCodester distributes the project as open-source PHP code. Administrators should modify /edit_class.php to cast the ID parameter to an integer and use prepared statements with bound parameters (for example, PDO with bindValue(':id', $id, PDO::PARAM_INT)). Track the SourceCodester Resource and the VulDB CVE Entry for updated fixes.

Workarounds

Enforce server-side validation that rejects any ID value that is not a positive integer before it reaches the database layer.
Apply least-privilege database credentials so the application user cannot read unrelated schemas or execute DDL statements.
Disable public exposure of administrative pages such as /edit_class.php and require authenticated, IP-restricted access.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /edit_class.php" \
    "chain,phase:2,deny,status:403,id:1026135260,msg:'Possible SQLi on edit_class.php ID parameter'"
    SecRule ARGS:ID "@rx (?i)(union(\s|\+)+select|sleep\s*\(|or\s+1=1|--|;)" "t:none,t:urlDecodeUni"