CVE-2026-75079: Class & Exam Timetabling System SQLI Flaw

CVE-2026-75079 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 affecting edit_subject2.php. Attackers can exploit the ID parameter remotely to manipulate database queries. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-75079 Overview

CVE-2026-75079 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_subject2.php script, where the ID parameter is passed to a database query without proper sanitization. Attackers can manipulate the argument remotely to inject arbitrary SQL statements. The weakness is categorized under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against exposed installations.

Critical Impact
Remote, unauthenticated attackers can inject SQL through the ID parameter of /edit_subject2.php, potentially exposing or modifying application data.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Component: /edit_subject2.php
Vulnerable parameter: ID

Discovery Timeline

2026-08-18 - CVE CVE-2026-75079 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75079

Vulnerability Analysis

The vulnerability affects the edit_subject2.php endpoint of the Class and Exam Timetabling System. The script accepts an ID argument through an HTTP request and concatenates the value into a SQL statement without parameterization or input validation. An attacker can supply crafted SQL syntax within the ID parameter to alter query logic. This behavior maps to [CWE-74], which covers improper neutralization of special elements used by a downstream interpreter.

The application is a PHP-based scheduling tool distributed through SourceCodester, a repository frequently used in academic and small-business deployments. Because the endpoint is reachable over the network and requires no authentication or user interaction, exploitation can be automated. Successful injection can be used to enumerate database schemas, extract records, or modify stored data depending on the underlying database privileges.

Root Cause

The root cause is the absence of prepared statements or input filtering when handling the ID request parameter in edit_subject2.php. User-controlled input reaches the SQL layer directly, allowing attacker-supplied fragments to be executed by the database engine.

Attack Vector

Exploitation occurs over the network by issuing an HTTP request to /edit_subject2.php with a malicious ID value. A public proof-of-concept referenced through the GitHub Issue Discussion and VulDB Vulnerability Details demonstrates the injection pattern. No credentials or user interaction are required.

The vulnerability manifests when the ID GET or POST parameter is concatenated into a query such as an UPDATE or SELECT targeting the subject table. Refer to the linked VulDB and GitHub references for reproduction details.

Detection Methods for CVE-2026-75079

Indicators of Compromise

HTTP requests to /edit_subject2.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences (--, #) in the ID parameter.
Web server access logs showing repeated requests to edit_subject2.php with unusually long or encoded ID values.
Database error messages or 500-series responses correlated with requests to the vulnerable endpoint.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag SQL injection payloads targeting the ID parameter of the timetabling application.
Enable database query logging and alert on syntactically malformed queries originating from the application service account.
Correlate web access logs with authentication events to identify unauthenticated scans of the /edit_subject2.php route.

Monitoring Recommendations

Monitor egress traffic from the web server for data exfiltration bursts following suspicious requests to edit_subject2.php.
Track new or unexpected reads from sensitive tables such as user, credential, or schedule tables.
Alert on repeated 4xx/5xx responses from the affected endpoint, which often indicate SQL injection probing.

How to Mitigate CVE-2026-75079

Immediate Actions Required

Restrict network access to the Class and Exam Timetabling System until a patch is applied, using IP allowlisting or VPN gating.
Deploy WAF signatures that block SQL injection patterns on the ID parameter of /edit_subject2.php.
Audit database logs for unauthorized queries executed since deployment of version 1.0.

Patch Information

No official vendor patch has been published for SourceCodester Class and Exam Timetabling System 1.0 at the time of NVD publication. Administrators should monitor the SourceCodester Code Repository and the VulDB CVE Listing for updated remediation guidance.

Workarounds

Modify edit_subject2.php to use parameterized queries or prepared statements via PDO or mysqli bound parameters.
Cast the ID argument to an integer server-side before it is used in any SQL statement.
Enforce least-privilege database accounts so the web application cannot read or alter tables outside its required scope.

bash

# Example hardening: enforce integer casting in PHP before query execution
# $id = isset($_REQUEST['ID']) ? (int)$_REQUEST['ID'] : 0;
# $stmt = $pdo->prepare('UPDATE subject SET ... WHERE id = :id');
# $stmt->execute([':id' => $id]);