CVE-2026-14771: Class Timetabling System SQLi Flaw

CVE-2026-14771 Overview

CVE-2026-14771 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_exam1.php script, where the ID parameter is passed to a database query without proper sanitization. Attackers can manipulate the ID argument to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network, requires no authentication, and no user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic scanning and exploitation attempts against exposed installations.

Critical Impact
Unauthenticated remote attackers can inject SQL commands through the ID parameter of /edit_exam1.php, potentially exposing or modifying database contents.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
/edit_exam1.php endpoint
Deployments exposing the application to untrusted networks

Discovery Timeline

2026-07-05 - CVE-2026-14771 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14771

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The edit_exam1.php script accepts an ID parameter from the HTTP request and concatenates it into a SQL query executed against the backend database. Because the input is neither validated nor parameterized, an attacker can append SQL syntax that alters query logic.

Successful exploitation can lead to unauthorized read access to timetable records, tampering with exam records, and, depending on database privileges, broader disruption to the application. The advisory notes that the exploit has been published, which lowers the barrier for attackers to weaponize the flaw.

Root Cause

The root cause is direct concatenation of user-controlled input into a SQL statement inside edit_exam1.php. The application does not use prepared statements or bound parameters for the ID argument. Input filtering is absent, allowing SQL metacharacters such as single quotes, comment markers, and UNION clauses to reach the database interpreter.

Attack Vector

An attacker sends a crafted HTTP request to /edit_exam1.php with a malicious payload in the ID parameter. Because the endpoint is reachable over the network with no authentication or user interaction required, the attack can be executed by any remote party who can reach the application. Automated scanners can identify and exploit the flaw at scale.

Refer to the GitHub CVE report and VulDB entry for CVE-2026-14771 for additional technical context.

Detection Methods for CVE-2026-14771

Indicators of Compromise

HTTP requests to /edit_exam1.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the ID parameter.
Unexpected database errors or long response times originating from the timetabling application.
Access patterns from a single source enumerating sequential or malformed ID values.

Detection Strategies

Deploy web application firewall (WAF) signatures that identify SQL injection patterns targeting the ID parameter of edit_exam1.php.
Enable database query logging and alert on queries that reference the exam table with anomalous syntax or boolean tautologies such as OR 1=1.
Inspect web server access logs for requests to /edit_exam1.php with encoded payloads or unusually long query strings.

Monitoring Recommendations

Correlate application, web server, and database logs to identify multi-stage injection attempts.
Baseline normal parameter values for ID and alert on deviations from expected numeric input.
Monitor outbound connections from the database server, which can indicate exfiltration following successful injection.

How to Mitigate CVE-2026-14771

Immediate Actions Required

Restrict access to the timetabling application to trusted networks or place it behind a VPN until a fix is applied.
Deploy WAF rules that block SQL injection payloads targeting /edit_exam1.php.
Audit the database for unauthorized modifications, rogue accounts, and altered timetable or exam records.

Patch Information

No official vendor patch has been published for CVE-2026-14771 at the time of writing. Administrators should monitor the SourceCodester website and the VulDB advisory for updates. In the absence of a vendor fix, apply the workarounds below and consider modifying edit_exam1.php to use prepared statements with bound parameters.

Workarounds

Rewrite the affected query in edit_exam1.php to use parameterized statements via PDO or mysqli prepared statements.
Enforce strict server-side validation that rejects any non-integer value for the ID parameter.
Apply least-privilege principles to the database account used by the application, removing DROP, ALTER, and file system privileges.
Disable the vulnerable endpoint if it is not required for production use.

bash

# Example nginx rule to reject non-numeric ID parameters
location = /edit_exam1.php {
    if ($arg_id !~ "^[0-9]+$") {
        return 400;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}