CVE-2026-86220: Class and Exam Timetabling SQL Injection

CVE-2026-86220 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 affecting the course parameter in modal_add_course.php. This vulnerability allows remote attackers to manipulate database queries. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-86220 Overview

CVE-2026-86220 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the mysqli_query call within /admin/modal_add_course.php, where the course argument is passed unsanitized into a database query. Remote attackers can manipulate this parameter to inject arbitrary SQL statements. The exploit is publicly disclosed, lowering the barrier for opportunistic abuse. The weakness is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Remote, unauthenticated attackers can inject SQL statements through the course parameter, exposing database contents and enabling record manipulation in affected timetabling deployments.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Component: /admin/modal_add_course.php
Vulnerable function: mysqli_query invoked with the course argument

Discovery Timeline

2026-09-06 - CVE-2026-86220 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86220

Vulnerability Analysis

The vulnerability is a classic SQL injection in the administrative course-creation workflow. When an authenticated or unauthenticated request reaches /admin/modal_add_course.php, the course parameter is concatenated into a SQL statement executed via mysqli_query. Because the application does not use parameterized queries or apply input escaping, attacker-controlled content becomes part of the query grammar.

An attacker can extract data from arbitrary tables, modify course records, or escalate the attack toward authentication bypass depending on the surrounding query logic. The exploit is reachable over the network without user interaction. Public proof-of-concept material referenced in the GitHub Issue Tracker increases the likelihood of automated scanning.

Root Cause

The root cause is missing input neutralization before dynamic SQL construction. The course argument flows directly from the HTTP request into mysqli_query without prepared statements or escaping via mysqli_real_escape_string. This aligns with [CWE-74] and its child weakness [CWE-89] (SQL Injection).

Attack Vector

The attack is delivered over the network by submitting a crafted HTTP request to the vulnerable endpoint. No privileges or user interaction are required to trigger the injection. Attackers typically use boolean-based, error-based, or UNION-based payloads to enumerate the schema, then exfiltrate credentials or session data.

No verified exploit code is republished here. Refer to the VulDB Vulnerability Details and VulDB CVE Record for public technical references.

Detection Methods for CVE-2026-86220

Indicators of Compromise

HTTP POST requests to /admin/modal_add_course.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( inside the course parameter.
Web server or PHP error logs referencing mysqli_query failures, malformed SQL, or unexpected result set sizes.
Sudden appearance of new administrative course records or modified rows without a corresponding legitimate admin session.

Detection Strategies

Deploy a web application firewall (WAF) signature that inspects the course parameter for SQL grammar tokens on the modal_add_course.php path.
Correlate database audit logs with web access logs to flag queries containing tautologies (for example OR 1=1) originating from the timetabling application.
Hunt for anomalous HTTP User-Agent strings such as sqlmap accessing /admin/ endpoints.

Monitoring Recommendations

Enable verbose access logging on the /admin/ directory and forward logs to a centralized analytics platform.
Monitor outbound database traffic for large or unusual result set transfers following requests to the vulnerable endpoint.
Alert on repeated 500-series responses from modal_add_course.php, which frequently accompany injection probing.

How to Mitigate CVE-2026-86220

Immediate Actions Required

Restrict network access to /admin/modal_add_course.php to trusted management networks or place it behind VPN and IP allowlists.
Deploy WAF rules that block SQL metacharacters in the course parameter until a code-level fix is applied.
Review database accounts used by the application and revoke privileges beyond those required for normal timetabling operations.

Patch Information

At time of publication, no vendor patch is listed in the NVD entry or the SourceCodester Resource references. Administrators should treat the deployment as unpatched and prioritize source-level remediation. Track the GitHub Issue Tracker and VulDB CTI Information for updates.

Workarounds

Modify /admin/modal_add_course.php to use mysqli prepared statements with bound parameters instead of string concatenation.
Apply mysqli_real_escape_string to all request parameters as an interim compensating control while refactoring queries.
Enforce server-side input validation that restricts the course field to an expected alphanumeric character set and length.

bash

# Example Apache configuration to block obvious SQLi payloads on the vulnerable path
<Location "/admin/modal_add_course.php">
    SetEnvIfNoCase Request_URI "(union|select|sleep|--|;|')" sqli_attempt
    <RequireAll>
        Require all granted
        Require not env sqli_attempt
    </RequireAll>
</Location>