CVE-2026-86208: Class & Exam Timetabling System SQLi Flaw

CVE-2026-86208 Overview

CVE-2026-86208 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /delete_teacher.php script, where the ID parameter is passed directly into a database query without proper sanitization. Remote attackers can inject arbitrary SQL statements without authentication or user interaction. The exploit code has been publicly disclosed, increasing the likelihood of opportunistic exploitation against exposed installations. The weakness is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can manipulate the ID parameter in /delete_teacher.php to execute arbitrary SQL, leading to unauthorized data access, modification, or deletion within the application database.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Deployments exposing the /delete_teacher.php endpoint
Installations without upstream input validation or WAF filtering

Discovery Timeline

2026-09-06 - CVE-2026-86208 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86208

Vulnerability Analysis

The vulnerability exists in the teacher deletion workflow of the Class and Exam Timetabling System. The /delete_teacher.php endpoint accepts an ID parameter that is concatenated into a SQL statement before execution. Because the value is not parameterized or sanitized, attackers can append additional SQL clauses to alter query logic. The attack executes over the network and requires no authentication or user interaction, making mass scanning trivial. Public exploit availability further reduces the technical barrier for adversaries targeting exposed instances.

Root Cause

The root cause is unsafe construction of a SQL query using untrusted request input. The application interpolates the ID argument directly into the query string rather than binding it as a parameter. This pattern maps to [CWE-74] and specifically CWE-89 (SQL Injection), a subclass of improper neutralization. Absence of type enforcement on the numeric identifier compounds the issue by allowing string payloads to reach the SQL engine.

Attack Vector

An attacker issues an HTTP request to /delete_teacher.php with a crafted ID parameter containing SQL metacharacters such as single quotes, UNION SELECT clauses, or time-based payloads. Successful exploitation permits reading arbitrary tables, dumping credentials, altering timetable records, or destroying data through stacked queries. Given the endpoint's name, exploitation can also trigger unintended row deletions across related tables. Refer to the VulDB entry for CVE-2026-86208 and the public GitHub issue for technical details on the disclosed payload.

Detection Methods for CVE-2026-86208

Indicators of Compromise

HTTP requests to /delete_teacher.php containing SQL metacharacters such as ', --, ;, UNION, SELECT, or SLEEP( in the ID parameter.
Web server logs showing repeated requests to delete_teacher.php from a single source with varying ID values.
Database error messages returned to clients referencing MySQL syntax errors tied to the teacher deletion query.
Unexpected DELETE or SELECT statements in database audit logs originating from the application service account.

Detection Strategies

Deploy signatures on web application firewalls to flag SQL injection patterns targeting ID parameters on PHP endpoints.
Enable database query logging and alert on anomalous query structures issued by the timetabling application.
Correlate authentication-less requests to administrative PHP scripts with subsequent database modification events.

Monitoring Recommendations

Baseline normal request volume for /delete_teacher.php and alert on deviations that suggest automated scanning.
Monitor egress traffic from the web server for large data transfers that could indicate database exfiltration.
Aggregate web, application, and database telemetry into a central data lake for cross-source correlation and threat hunting.

How to Mitigate CVE-2026-86208

Immediate Actions Required

Restrict network access to the Class and Exam Timetabling System until a vendor patch is available.
Place the application behind a web application firewall with SQL injection rulesets enabled.
Audit the database for unauthorized modifications, particularly within teacher, class, and schedule tables.
Rotate any credentials, tokens, or session secrets stored in the application database.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor SourceCodester for updates and review the VulDB advisory for remediation guidance. Until an official fix is issued, apply the compensating controls described below.

Workarounds

Modify /delete_teacher.php to use parameterized queries or prepared statements with type-cast integer bindings for the ID argument.
Enforce server-side validation that rejects any ID value that is not a positive integer before it reaches the database layer.
Require authenticated administrator sessions for teacher management endpoints and enforce CSRF tokens on state-changing requests.
Apply the principle of least privilege to the database user account so it cannot execute destructive operations on unrelated tables.

bash

# Example nginx rule to block obvious SQLi patterns on the affected endpoint
location = /delete_teacher.php {
    if ($arg_id ~* "('|--|;|union|select|sleep|benchmark)") {
        return 403;
    }
    # Additionally require an authenticated session cookie
    if ($cookie_admin_session = "") {
        return 401;
    }
}