CVE-2026-14732: Class Exam Timetabling SQL Injection

CVE-2026-14732 Overview

CVE-2026-14732 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_exam.php file, where the ID parameter is passed to a database query without proper sanitization. Attackers can manipulate the ID argument to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network without authentication or user interaction. Public disclosure of the exploit has occurred, increasing the likelihood of opportunistic attacks against exposed installations. The issue is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL commands through /edit_exam.php, potentially reading, modifying, or deleting timetabling data stored in the backend database.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Deployments exposing /edit_exam.php to untrusted networks
Installations that have not applied vendor mitigations

Discovery Timeline

2026-07-05 - CVE-2026-14732 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14732

Vulnerability Analysis

The vulnerability is a classic SQL injection weakness in a PHP web application. The edit_exam.php script accepts an ID request parameter and incorporates it into a SQL statement without parameterization or input validation. An attacker supplies crafted SQL syntax through the ID value, altering the intended query logic executed by the backend database.

Because the endpoint is reachable over the network and requires no authentication, attack complexity is low. Successful exploitation can lead to disclosure of timetable, exam, and user records, tampering with scheduling data, or destructive operations against database tables. The EPSS estimate places exploitation probability at 0.263%, and public proof-of-concept material referenced by VulDB increases operational risk for exposed instances.

Root Cause

The root cause is improper neutralization of user-supplied input [CWE-74]. The application concatenates the ID parameter directly into a SQL query string rather than binding it as a parameter. Any single-quote, comment sequence, or UNION construct submitted by the client is interpreted as SQL syntax by the database engine.

Attack Vector

An attacker sends an HTTP request to /edit_exam.php with a malicious ID value. Typical payloads use boolean-based, error-based, UNION-based, or time-based blind SQL injection techniques to extract data or infer database structure. No credentials or user interaction are required, and the attack can be automated with off-the-shelf tooling. See the GitHub issue report for technical context on the exploitation path.

Detection Methods for CVE-2026-14732

Indicators of Compromise

HTTP requests to /edit_exam.php containing SQL metacharacters such as ', --, UNION SELECT, SLEEP(, or information_schema in the ID parameter
Web server logs showing repeated requests to edit_exam.php with varying ID values from a single source address
Database error messages returned in HTTP responses referencing MySQL syntax errors
Unexpected read or write activity against timetabling database tables outside normal application workflow

Detection Strategies

Deploy web application firewall rules that flag SQL injection patterns targeting the ID parameter on edit_exam.php
Enable database query logging and alert on queries with suspicious constructs originating from the application account
Correlate web server access logs with database audit trails to identify anomalous query volumes tied to specific endpoints

Monitoring Recommendations

Monitor outbound connections from the web server to detect data exfiltration following injection attempts
Track authentication anomalies and privilege changes in the backing database
Baseline normal request patterns for /edit_exam.php and alert on deviations in parameter length or character distribution

How to Mitigate CVE-2026-14732

Immediate Actions Required

Restrict network access to the Class and Exam Timetabling System, placing it behind authenticated VPN or IP allowlisting until a fix is applied
Deploy a web application firewall with SQL injection signatures in blocking mode for the /edit_exam.php endpoint
Audit database accounts used by the application and remove privileges beyond those strictly required
Review web server and database logs for prior exploitation attempts using the indicators above

Patch Information

No official vendor patch is referenced in the advisory data for SourceCodester Class and Exam Timetabling System 1.0. Consult the SourceCodester site and the VulDB entry for CVE-2026-14732 for updates on vendor remediation. Until a patch is available, operators should apply the workarounds below.

Workarounds

Modify edit_exam.php to use prepared statements with parameter binding via PDO or MySQLi for all database queries referencing the ID value
Validate that ID is a positive integer before passing it to any database call, rejecting non-numeric input
Apply least-privilege database credentials so the application account cannot execute DROP, ALTER, or cross-database queries
Disable verbose SQL error output in PHP configuration to reduce information leakage during probing

bash

# Example hardening: enforce numeric ID at the web tier via nginx
location = /edit_exam.php {
    if ($arg_id !~ "^[0-9]+$") {
        return 400;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}