CVE-2026-14772: Class Timetabling System SQLi Flaw

CVE-2026-14772 Overview

CVE-2026-14772 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The flaw resides in the /edit_course1.php script, where the ID parameter is passed to a database query without proper sanitization. An unauthenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks. The weakness is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote, unauthenticated attackers can inject SQL statements through the ID parameter of /edit_course1.php, leading to unauthorized read or modification of the underlying database.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Deployments exposing /edit_course1.php to untrusted networks
Web applications built on the referenced SourceCodester codebase without input validation patches

Discovery Timeline

2026-07-05 - CVE-2026-14772 published to the National Vulnerability Database (NVD)
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14772

Vulnerability Analysis

The vulnerability exists in the /edit_course1.php endpoint of the Class and Exam Timetabling System. The application accepts the ID request parameter and concatenates it into a SQL query without parameterization or type validation. Because no authentication is required to reach the vulnerable code path, attackers can send crafted HTTP requests directly to the endpoint. Successful injection allows extraction of database contents, modification of course records, and potential lateral movement into administrative functions. The exploit has been publicly disclosed, according to the VulDB entry for CVE-2026-14772.

Root Cause

The root cause is improper neutralization of user-controlled input, tracked as [CWE-74]. The ID parameter flows directly into a SQL statement without prepared statements, parameter binding, or input filtering. PHP's dynamic string concatenation makes such flaws trivial to exploit when developers use raw query construction instead of PDO prepared statements or mysqli_prepare.

Attack Vector

The attack is executed remotely over the network, requires no privileges, and needs no user interaction. An attacker sends a GET or POST request to /edit_course1.php with a malicious ID value containing SQL syntax such as UNION SELECT statements or boolean-based blind payloads. The vulnerability manifests as first-order SQL injection where the injected payload is directly reflected in the query executed against the database. See the GitHub Issue Report for reproduction details.

Detection Methods for CVE-2026-14772

Indicators of Compromise

HTTP requests to /edit_course1.php containing SQL syntax such as UNION, SELECT, SLEEP(, --, or OR 1=1 in the ID parameter
Unusual database error messages returned by the timetabling application in web server logs
Anomalous spikes in query volume or long-running queries against the timetabling database
Unexpected data modifications in course-related tables or new administrative accounts

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL metacharacters in the ID parameter of /edit_course1.php
Enable database query auditing to log queries originating from the timetabling application
Correlate web access logs with database logs to identify parameter tampering patterns
Use static analysis on the PHP source to identify additional unsanitized query construction sites

Monitoring Recommendations

Monitor for repeated 500 responses from /edit_course1.php, which often indicate injection probing
Alert on outbound database connections from the web server to unexpected destinations
Track authentication events on database accounts used by the application for privilege abuse

How to Mitigate CVE-2026-14772

Immediate Actions Required

Restrict network access to the Class and Exam Timetabling System to trusted internal users until a patch is applied
Deploy WAF signatures blocking SQL injection payloads targeting the ID parameter
Review database accounts used by the application and enforce least-privilege access
Audit database contents for signs of tampering, including course records and user tables

Patch Information

At the time of publication, no official vendor patch is listed in the NVD entry for CVE-2026-14772. Administrators should monitor the SourceCodester website and the VulDB advisory for remediation updates. In the absence of a vendor fix, modify the edit_course1.php source to replace string concatenation with prepared statements using PDO::prepare and bound parameters.

Workarounds

Rewrite the vulnerable query in /edit_course1.php to use parameterized queries with PDO or mysqli prepared statements
Validate that the ID parameter is a strictly numeric value before passing it to any query
Place the application behind an authenticated reverse proxy to block unauthenticated access
Disable or remove the /edit_course1.php endpoint if not required for production operations

bash

# Example WAF rule (ModSecurity) blocking SQL metacharacters on the ID parameter
SecRule ARGS:ID "@rx (?i)(union(.*?)select|sleep\(|--|or\s+1=1|;)" \
    "id:1014772,phase:2,deny,status:403,\
    msg:'CVE-2026-14772 SQLi attempt on edit_course1.php',\
    logdata:'Matched %{MATCHED_VAR}'"