CVE-2026-13565: Class Timetabling System SQLi Flaw

CVE-2026-13565 Overview

CVE-2026-13565 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The flaw resides in the /edit_class1.php script, where the ID parameter is passed directly into a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is remotely exploitable over the network and requires no authentication or user interaction. The exploit has been publicly disclosed, increasing the likelihood of opportunistic scanning and abuse against exposed installations. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact

Unauthenticated remote attackers can inject SQL statements through the ID parameter of /edit_class1.php, potentially exposing or altering database records.

Affected Products

• SourceCodester Class and Exam Timetabling System 1.0
• The vulnerable component is the /edit_class1.php endpoint
• No vendor-supplied fixed version has been published

Discovery Timeline

• 2026-06-29 - CVE-2026-13565 published to NVD
• 2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13565

Vulnerability Analysis

The vulnerability exists in the class edit workflow of SourceCodester Class and Exam Timetabling System 1.0. The /edit_class1.php script accepts an ID parameter from client-supplied input and incorporates it into a SQL statement without parameterization or input validation. An attacker can supply crafted SQL payloads through this parameter to alter the intended query logic.

Successful exploitation allows extraction of database contents, modification of stored timetabling records, or authentication bypass through query manipulation. Because the affected system is a PHP web application typically deployed on internet-accessible hosts, exploitation can be performed remotely with a single HTTP request. Public disclosure of the exploit lowers the barrier for automated scanners and low-skill attackers.

Root Cause

The root cause is improper neutralization of user-controlled input before it is concatenated into a SQL query. The application does not use prepared statements or parameter binding for the ID value received by /edit_class1.php. This is a classic instance of [CWE-74] where special SQL metacharacters are not filtered or escaped.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends an HTTP request to /edit_class1.php with a manipulated ID query parameter containing SQL syntax such as boolean-based, union-based, or time-based payloads. The backend database then executes the injected clauses, returning data or altering state depending on the payload. No privileges or user interaction are required.

No verified proof-of-concept code is available in the referenced sources. Technical details are documented in the GitHub Issue Discussion and VulDB CVE Details entries.

Detection Methods for CVE-2026-13565

Indicators of Compromise

• HTTP requests to /edit_class1.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #) in the ID parameter
• Web server access logs showing repeated requests to /edit_class1.php with unusually long or encoded ID values
• Database error messages referencing syntax errors originating from the timetabling application
• Unexpected outbound connections or data exfiltration from the web server hosting the application

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect the ID parameter of /edit_class1.php for SQL injection patterns
• Enable database query logging and alert on malformed queries or queries returning abnormally large result sets from the timetabling schema
• Correlate web access logs with database audit trails to identify request-to-query patterns consistent with injection attempts

Monitoring Recommendations

• Monitor HTTP 500 responses and PHP error logs for SQL syntax errors tied to edit_class1.php
• Track authentication anomalies and privilege changes in the application database following suspicious ID parameter activity
• Baseline normal request volumes to /edit_class1.php and alert on sudden spikes indicative of automated scanning

How to Mitigate CVE-2026-13565

Immediate Actions Required

• Restrict network access to the Class and Exam Timetabling System, limiting exposure to trusted networks or VPN only
• Deploy WAF signatures that block SQL injection payloads targeting the ID parameter of /edit_class1.php
• Audit the application database for unauthorized modifications, unexpected accounts, or data exfiltration indicators
• Review web server access logs for prior exploitation attempts against /edit_class1.php

Patch Information

No official vendor patch is referenced in the available sources. Organizations should monitor the SourceCodester Security Resource and the VulDB Vulnerability Info entry for updates. As an interim measure, developers maintaining forked or customized deployments should refactor /edit_class1.php to use prepared statements with bound parameters and enforce strict type validation on the ID value (for example, casting to integer).

Workarounds

• Modify /edit_class1.php to cast the ID parameter to an integer before use in any SQL query
• Replace inline SQL concatenation with PDO or MySQLi prepared statements using parameter binding
• Apply least-privilege database accounts so the web application cannot execute administrative SQL commands
• Disable or remove the vulnerable endpoint if the edit-class functionality is not required in production

# Example WAF rule concept blocking SQL metacharacters in the ID parameter
# ModSecurity-style illustration
SecRule ARGS:ID "@rx (['\";]|--|\bUNION\b|\bSELECT\b|\bSLEEP\b)" \
  "id:1013565,phase:2,deny,status:403,\
   msg:'CVE-2026-13565 SQLi attempt on edit_class1.php'"