CVE-2026-15597: Class Timetabling System SQLi Flaw

CVE-2026-15597 Overview

CVE-2026-15597 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_exam2.php script, where the ID parameter is passed directly into a database query without proper sanitization. Attackers can exploit this weakness remotely without authentication or user interaction. A public exploit has been released, increasing the likelihood of opportunistic attacks against exposed instances. The vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output.

Critical Impact
Remote unauthenticated attackers can manipulate database queries through the ID parameter in /edit_exam2.php, potentially exposing, modifying, or deleting stored exam and scheduling data.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
/edit_exam2.php component
Deployments exposing the application to untrusted networks

Discovery Timeline

2026-07-13 - CVE-2026-15597 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15597

Vulnerability Analysis

The vulnerability affects the edit_exam2.php endpoint of the Class and Exam Timetabling System. The application accepts an ID argument from the client and incorporates it into a SQL statement without parameterization or input validation. This design allows attackers to inject arbitrary SQL syntax into the query context.

Because the affected endpoint does not require authentication, exploitation only requires network reachability to the vulnerable server. Public disclosure includes exploit details, which lowers the barrier for adversaries seeking to weaponize the flaw. Successful exploitation may allow attackers to read arbitrary database records, alter timetable data, or enumerate schema information.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a SQL query. The application constructs queries through string concatenation using the ID parameter. No prepared statements, parameterized queries, or input filters intercept the malicious characters before they reach the database driver.

Attack Vector

The attack vector is network-based. An adversary sends a crafted HTTP request to /edit_exam2.php with a manipulated ID value containing SQL metacharacters. No credentials or user interaction are required. See the VulDB Vulnerability Details and GitHub Issue Tracker for reproduction context.

Detection Methods for CVE-2026-15597

Indicators of Compromise

HTTP requests to /edit_exam2.php containing SQL metacharacters such as single quotes, UNION SELECT, OR 1=1, or comment sequences (--, #) in the ID parameter.
Web server access logs showing unusually long or encoded ID values from unknown source addresses.
Database error messages returned to clients or logged during requests to edit_exam2.php.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the ID query parameter for SQL injection payloads.
Correlate HTTP 500 responses from edit_exam2.php with parameter tampering patterns.
Review database audit logs for unexpected queries against timetabling tables originating from the web application user.

Monitoring Recommendations

Enable verbose access logging on the web server hosting the Timetabling System and forward logs to a central SIEM.
Alert on repeated 4xx or 5xx responses tied to /edit_exam2.php from the same source address.
Monitor for outbound connections from the database host that deviate from baseline behavior.

How to Mitigate CVE-2026-15597

Immediate Actions Required

Restrict network access to the Class and Exam Timetabling System until a fix is applied, using firewall rules or VPN gating.
Audit /edit_exam2.php requests in existing logs for signs of prior exploitation.
Rotate database credentials used by the application if compromise is suspected.

Patch Information

No vendor patch is referenced in the published advisory sources at this time. Administrators should monitor the SourceCodester website and the VulDB CVE Reference for future updates. In the interim, apply code-level fixes by replacing string-concatenated SQL with parameterized queries or prepared statements for all parameters consumed by edit_exam2.php.

Workarounds

Add server-side input validation to reject non-numeric ID values before they reach the database layer.
Deploy WAF signatures that block SQL injection patterns targeting the ID parameter of edit_exam2.php.
Enforce least-privilege permissions on the database account used by the application to limit the impact of successful injection.

bash

# Example ModSecurity rule to block SQLi payloads targeting the ID parameter
SecRule REQUEST_URI "@contains /edit_exam2.php" \
    "chain,phase:2,deny,status:403,id:1015597,msg:'Possible SQLi in edit_exam2.php ID param'"
    SecRule ARGS:ID "@detectSQLi" "t:none,t:urlDecodeUni"