CVE-2026-14770: Class & Exam Timetabling SQLi Flaw

CVE-2026-14770 Overview

CVE-2026-14770 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_room.php script, where the ID parameter is passed to a database query without proper sanitization. Remote attackers can manipulate the ID argument to inject arbitrary SQL statements. The vulnerability requires no authentication or user interaction, and a public exploit is available. Successful exploitation allows attackers to read, modify, or delete records in the underlying database used by the timetabling application. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL through the ID parameter of /edit_room.php to access or manipulate database contents.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Component: /edit_room.php
Parameter: ID

Discovery Timeline

2026-07-05 - CVE-2026-14770 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14770

Vulnerability Analysis

The vulnerability affects the room edit functionality of the Class and Exam Timetabling System, a PHP-based web application. The /edit_room.php endpoint accepts an ID GET parameter used to identify the room record targeted for modification. The application concatenates this parameter directly into a SQL statement without parameterization or input validation. Attackers can supply crafted SQL syntax through the ID argument to break out of the intended query context.

The attack is remotely exploitable over the network and requires no privileges or user interaction. Public exploit details have been disclosed on VulDB and a GitHub issue tracker, increasing the likelihood of opportunistic exploitation against exposed instances.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a downstream SQL interpreter [CWE-74]. The ID parameter is inserted into a query string using direct string concatenation rather than prepared statements or parameterized queries. No allow-list validation, type casting, or escaping is applied before the value reaches the database driver.

Attack Vector

An attacker sends an HTTP request to /edit_room.php with a manipulated ID parameter containing SQL syntax such as UNION SELECT, boolean-based blind payloads, or time-based delays. The database processes the injected clauses alongside the intended query. Depending on database privileges, attackers can enumerate schemas, exfiltrate credentials stored in the application database, alter timetable data, or pivot to further attacks against the host.

See the VulDB entry for CVE-2026-14770 and the public CVE report on GitHub for technical details of the disclosed proof-of-concept.

Detection Methods for CVE-2026-14770

Indicators of Compromise

HTTP GET requests to /edit_room.php containing SQL metacharacters such as ', ", --, UNION, SELECT, SLEEP(, or BENCHMARK( in the ID parameter.
Web server access logs showing unusually long or URL-encoded values for the ID query string parameter.
Database error messages referencing syntax errors originating from queries issued by the timetabling application.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the ID parameter on /edit_room.php for SQL injection patterns and block anomalous payloads.
Enable verbose query logging on the backing MySQL or MariaDB instance and alert on syntactically malformed statements originating from the application user.
Correlate web access logs with database audit logs to identify request-to-query anomalies indicating injection attempts.

Monitoring Recommendations

Monitor for outbound data volume spikes from the database host that could indicate bulk exfiltration through UNION-based injection.
Track authentication tables and privileged records for unauthorized modifications following suspicious /edit_room.php requests.
Alert on repeated 500-series HTTP responses from /edit_room.php, which often accompany injection probing.

How to Mitigate CVE-2026-14770

Immediate Actions Required

Restrict network access to the Class and Exam Timetabling System until a patched version is available, ideally placing it behind authenticated VPN access.
Deploy WAF signatures that block SQL injection payloads targeting the ID parameter of /edit_room.php.
Audit the application database for unauthorized data changes and rotate any credentials stored in or accessible from the application database.

Patch Information

No official vendor patch has been published at the time of NVD disclosure. SourceCodester has not released a fixed version of Class and Exam Timetabling System 1.0. Administrators should monitor the SourceCodester website for updates and apply source-level fixes that replace concatenated SQL with parameterized queries.

Workarounds

Modify /edit_room.php to cast the ID parameter to an integer using intval() before use, or migrate the query to prepared statements with bound parameters via PDO or MySQLi.
Restrict the database account used by the application to the minimum privileges required, removing FILE, DROP, and cross-schema permissions.
Disable public exposure of the administrative interface and require authentication and IP allow-listing for access to edit endpoints.

bash

# Example PHP hardening for /edit_room.php using PDO prepared statements
$id = filter_input(INPUT_GET, 'ID', FILTER_VALIDATE_INT);
if ($id === false || $id === null) {
    http_response_code(400);
    exit('Invalid room ID');
}

$stmt = $pdo->prepare('SELECT * FROM rooms WHERE id = :id');
$stmt->execute([':id' => $id]);
$room = $stmt->fetch(PDO::FETCH_ASSOC);