CVE-2026-13566 Overview
CVE-2026-13566 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /preview3.php script, where the course_year_section parameter is passed to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is remotely exploitable over the network and requires no authentication or user interaction. A public exploit reference has been disclosed through VulDB and a GitHub issue, increasing the likelihood of opportunistic exploitation against exposed installations.
Critical Impact
Unauthenticated remote attackers can inject SQL queries through the course_year_section parameter of /preview3.php, potentially exposing or modifying data in the underlying timetabling database.
Affected Products
- SourceCodester Class and Exam Timetabling System 1.0
- Deployments exposing /preview3.php to untrusted networks
- Environments running the vulnerable PHP application on shared web hosting
Discovery Timeline
- 2026-06-29 - CVE-2026-13566 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-13566
Vulnerability Analysis
The vulnerability is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). The /preview3.php endpoint accepts the course_year_section argument from client-supplied input and incorporates it directly into a SQL statement. Because the application does not use parameterized queries or apply escaping, an attacker can break out of the intended query context.
Successful exploitation allows attackers to read arbitrary rows from the database, enumerate schema metadata, and potentially modify records depending on the privileges of the database user. The EPSS probability is 0.263%, but the public availability of exploit details raises operational risk for internet-facing deployments.
Root Cause
The root cause is missing input validation and the absence of prepared statements when handling the course_year_section request parameter. User-controlled data is concatenated into a SQL query string, allowing injected clauses such as UNION SELECT or boolean-based payloads to alter query semantics.
Attack Vector
The attack vector is network-based. An attacker crafts an HTTP request to /preview3.php with a malicious value in the course_year_section parameter. No credentials or user interaction are required. See the GitHub issue on CVE-2026-13566 and the VulDB CVE-2026-13566 Entry for technical references.
No verified proof-of-concept code is reproduced here. The vulnerability manifests when the vulnerable parameter is submitted via GET or POST to the affected script, and the injected payload is executed by the backend MySQL/MariaDB database.
Detection Methods for CVE-2026-13566
Indicators of Compromise
- HTTP requests to /preview3.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in the course_year_section parameter
- Unusually long or URL-encoded values in the course_year_section argument in web server access logs
- Database error messages referencing syntax errors originating from queries built by preview3.php
- Unexpected outbound queries or data volume spikes from the web application database user
Detection Strategies
- Deploy web application firewall (WAF) rules that detect SQL injection patterns targeting query parameters, with specific coverage for the course_year_section field
- Enable database query logging and alert on anomalous statements referencing information_schema or containing UNION SELECT from the timetabling application
- Correlate web access logs with database logs to identify request-to-query chains involving /preview3.php
Monitoring Recommendations
- Continuously monitor requests to /preview3.php and baseline the expected parameter values
- Alert on repeated 500-series HTTP responses tied to database exceptions from the affected endpoint
- Track authentication anomalies and administrative account changes in the application database that could follow a successful injection
How to Mitigate CVE-2026-13566
Immediate Actions Required
- Restrict network access to the Class and Exam Timetabling System until a fix is applied, using IP allowlisting or VPN-only access
- Deploy WAF rules that block SQL injection payloads targeting the course_year_section parameter on /preview3.php
- Audit database user privileges and reduce the application account to the minimum permissions required
- Review web server and database logs for evidence of prior exploitation attempts
Patch Information
No official vendor patch has been referenced in the disclosure. Administrators should monitor the SourceCodester Security Resource and the VulDB Vulnerability #374574 entry for update announcements. Until an official fix is released, apply code-level mitigations locally by replacing dynamic SQL with prepared statements using PDO or mysqli with bound parameters.
Workarounds
- Modify /preview3.php to validate course_year_section against a strict allowlist of expected values before use in any query
- Refactor affected queries to use parameterized statements, ensuring user input is never concatenated into SQL
- Place the application behind an authenticated reverse proxy to prevent unauthenticated internet access
- Disable or remove the /preview3.php endpoint if it is not required for production use
# Example ModSecurity rule to block SQLi patterns on the vulnerable parameter
SecRule ARGS:course_year_section "@rx (?i)(union(\s|/\*.*\*/)+select|--|;|/\*|\bor\b\s+\d+=\d+)" \
"id:1013566,phase:2,deny,status:403,log,msg:'CVE-2026-13566 SQLi attempt on preview3.php'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
