CVE-2026-14642: Class Timetabling System SQLi Flaw

CVE-2026-14642 Overview

CVE-2026-14642 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw exists in the /edit_class2.php script, where the ID parameter is passed to a backend database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network and requires no authentication or user interaction. A public exploit is available, increasing the likelihood of opportunistic abuse. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The system is a PHP-based web application distributed through the SourceCodester project archive.

Critical Impact
Unauthenticated remote attackers can inject SQL through the ID parameter of /edit_class2.php, exposing or modifying backend database contents.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
edit_class2.php component within the application
Deployments sourced from the SourceCodester Resource Archive

Discovery Timeline

2026-07-04 - CVE-2026-14642 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14642

Vulnerability Analysis

The vulnerability resides in the edit_class2.php endpoint of the Class and Exam Timetabling System 1.0. The script accepts an ID argument from HTTP request input and concatenates it directly into a SQL statement executed against the backend database. Because the input is neither validated nor parameterized, attackers can supply crafted SQL fragments that alter query logic. The issue maps to [CWE-74] as an improper neutralization of special elements in a downstream component. Public disclosure through VulDB Vulnerability #376158 and a corresponding GitHub Issue Report confirms the exploit is publicly documented.

Root Cause

The root cause is missing input sanitization and the absence of prepared statements in the edit_class2.php handler. User-controlled input flows directly into SQL query construction, allowing string breakout and injection of secondary clauses such as UNION SELECT, OR 1=1, or stacked queries depending on the database driver in use.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to /edit_class2.php with a malicious ID value. The manipulated payload modifies the underlying SQL statement, enabling data extraction, authentication bypass through logic tampering, or modification of records. The attack requires no privileges and no user interaction. See VulDB CVE-2026-14642 for exploit context and the GitHub Issue Report for reproduction details.

No verified proof-of-concept code is included here. Refer to the published references for exploitation details.

Detection Methods for CVE-2026-14642

Indicators of Compromise

HTTP requests to /edit_class2.php containing SQL metacharacters such as ', ", --, ;, UNION, or SELECT in the ID parameter.
Unusual database error responses returned to clients from the timetabling application.
Spikes in requests to edit_class2.php from a single source address or automated scanner user agents.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the ID parameter of /edit_class2.php for SQL injection patterns.
Enable verbose query logging on the backend MySQL/MariaDB instance and alert on syntactically anomalous statements originating from the application user.
Correlate web server access logs with database audit logs to identify request-to-query pairs that contain injected clauses.

Monitoring Recommendations

Monitor for repeated 4xx/5xx responses from edit_class2.php, which often indicate injection probing.
Alert on outbound data transfer volumes from the database host that exceed normal baselines.
Track new administrative or user rows created outside expected application workflows.

How to Mitigate CVE-2026-14642

Immediate Actions Required

Restrict network access to the Class and Exam Timetabling System 1.0 to trusted networks or place it behind an authenticated reverse proxy.
Deploy WAF signatures that block SQL injection payloads targeting the ID parameter of /edit_class2.php.
Audit database logs for prior exploitation attempts and rotate any credentials exposed by the application database user.

Patch Information

No official vendor patch is listed in the referenced advisories. Administrators should review the VulDB Vulnerability #376158 entry for update status and monitor the SourceCodester Resource Archive for revised releases. Until a fix is issued, modify edit_class2.php to use parameterized queries (mysqli_prepare or PDO with bound parameters) and cast the ID value to an integer before use.

Workarounds

Replace direct SQL concatenation in edit_class2.php with prepared statements and enforce integer casting on the ID parameter.
Apply least-privilege on the database account used by the application, removing DROP, ALTER, and cross-database read permissions.
Disable the vulnerable endpoint if the edit functionality is not required in production deployments.

bash

# Example: enforce integer cast and prepared statement in edit_class2.php
# $id = (int) $_GET['ID'];
# $stmt = $mysqli->prepare("SELECT * FROM classes WHERE id = ?");
# $stmt->bind_param("i", $id);
# $stmt->execute();