CVE-2026-75080 Overview
CVE-2026-75080 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_subject1.php script, where the ID parameter is passed directly to database queries without proper sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic exploitation against internet-facing installations. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Critical Impact
Remote unauthenticated attackers can inject SQL statements through the ID parameter of /edit_subject1.php, exposing database contents and enabling unauthorized data modification.
Affected Products
- SourceCodester Class and Exam Timetabling System 1.0
- /edit_subject1.php endpoint
- Deployments exposing the application to untrusted networks
Discovery Timeline
- 2026-08-18 - CVE-2026-75080 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75080
Vulnerability Analysis
The vulnerability exists in the /edit_subject1.php script of the Class and Exam Timetabling System. User-supplied input to the ID parameter reaches an SQL query without parameterization or input validation. Attackers submit crafted values through HTTP requests to inject arbitrary SQL clauses into the underlying query.
Exploitation requires no authentication and no user interaction. Because the affected script accepts requests over the network, adversaries can automate attacks against exposed instances. Publicly disclosed exploit details lower the barrier for attackers seeking to weaponize the flaw.
Root Cause
The application concatenates the ID request parameter directly into a SQL statement. It does not use prepared statements, parameterized queries, or escaping routines. This design pattern allows attacker-controlled input to alter query semantics, matching the [CWE-74] injection weakness class.
Attack Vector
An attacker sends an HTTP request to /edit_subject1.php with a malicious ID value. The injected SQL executes with the privileges of the application's database user. Typical outcomes include unauthorized data reads, modification of timetabling records, authentication bypass through UNION-based extraction, and, depending on database configuration, file read or write primitives.
See the GitHub issue discussion and VulDB entry for CVE-2026-75080 for additional technical context.
Detection Methods for CVE-2026-75080
Indicators of Compromise
- HTTP requests to /edit_subject1.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the ID parameter
- Unusual database error messages returned by the application to remote clients
- Unexpected read or write activity against timetabling database tables outside normal application workflows
Detection Strategies
- Deploy web application firewall signatures that inspect the ID query parameter for SQL injection patterns targeting /edit_subject1.php
- Enable database query logging and alert on statements originating from the timetabling application that contain UNION operators or boolean-based tautologies
- Correlate web server access logs with database audit logs to identify parameter tampering followed by anomalous query volume
Monitoring Recommendations
- Baseline normal request patterns to /edit_subject1.php and flag deviations in parameter length, character distribution, or request frequency
- Monitor for repeated 500-level HTTP responses from the endpoint, which may indicate injection probing
- Track outbound connections from the web server host to detect post-exploitation data staging
How to Mitigate CVE-2026-75080
Immediate Actions Required
- Restrict access to the Class and Exam Timetabling System to trusted networks until a vendor fix is available
- Deploy WAF rules that block SQL injection payloads targeting the ID parameter of /edit_subject1.php
- Audit database logs for signs of prior exploitation and rotate any credentials that may have been exposed
Patch Information
No vendor patch has been published in the referenced advisories at the time of NVD publication. Monitor the SourceCodester project site and the VulDB record for updates. Consider replacing the vulnerable code path with parameterized queries such as PDO prepared statements.
Workarounds
- Apply server-side input validation that enforces a strict integer type on the ID parameter before database interaction
- Configure the application's database account with least-privilege permissions to limit the impact of injected queries
- Disable or remove the /edit_subject1.php endpoint if the affected functionality is not required in the deployment
# Example WAF rule (ModSecurity) to block SQLi patterns in the ID parameter
SecRule ARGS:ID "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--\s|';)" \
"id:1075080,phase:2,deny,status:403,msg:'CVE-2026-75080 SQLi attempt on /edit_subject1.php'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
