CVE-2026-86221 Overview
CVE-2026-86221 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the mysqli_query function call within /admin/modal_add_course1.php. Attackers can manipulate the course argument to inject arbitrary SQL statements. The vulnerability is exploitable remotely without authentication and the exploit has been published publicly. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Critical Impact
Remote unauthenticated attackers can inject SQL statements through the course parameter, potentially exposing or modifying database contents used by the timetabling application.
Affected Products
- SourceCodester Class and Exam Timetabling System 1.0
- Component: /admin/modal_add_course1.php
- Vulnerable function: mysqli_query processing the course argument
Discovery Timeline
- 2026-09-06 - CVE-2026-86221 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86221
Vulnerability Analysis
The vulnerability exists in the administrative course-management workflow of the Class and Exam Timetabling System. When an administrator submits a new course via /admin/modal_add_course1.php, the course request parameter is concatenated directly into a SQL query that is executed by mysqli_query. Because the input is neither parameterized nor escaped, an attacker can break out of the intended string context and append arbitrary SQL clauses.
The attack surface is reachable over the network. According to public reporting, a working exploit has been released, lowering the barrier for opportunistic attackers scanning for exposed instances. The EPSS probability is 0.263%.
Root Cause
The root cause is improper neutralization of user-supplied input before it is passed to the database driver. The application relies on direct string composition to build SQL statements rather than using prepared statements with bound parameters. Any attacker-controlled content in the course parameter is treated as executable SQL syntax by the MySQL server.
Attack Vector
An attacker sends a crafted HTTP request to /admin/modal_add_course1.php with a malicious course value. Depending on the deployment, the endpoint may be reachable without authentication or accessible after weak credential handling. Successful injection can allow the attacker to enumerate database schema, extract stored records including administrator credentials, or manipulate scheduling data. The vulnerability manifests through direct concatenation of the course parameter into a mysqli_query call. Refer to the GitHub Issue Discussion and VulDB CVE-2026-86221 entries for the published proof of concept.
Detection Methods for CVE-2026-86221
Indicators of Compromise
- HTTP POST or GET requests to /admin/modal_add_course1.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #) in the course parameter.
- Unexpected MySQL error messages in application or web server logs referencing the course parameter.
- Sudden spikes in query latency or database CPU tied to requests against the course-add endpoint, indicating time-based blind injection attempts.
Detection Strategies
- Deploy web application firewall (WAF) rules that inspect the course parameter of /admin/modal_add_course1.php for SQL injection patterns.
- Enable MySQL general query logging in test environments and review queries originating from modal_add_course1.php for concatenated user input.
- Correlate authentication failures on the admin panel with subsequent requests to the vulnerable endpoint to identify scanning behavior.
Monitoring Recommendations
- Monitor egress network traffic from the web server for unexpected outbound connections that could indicate data exfiltration following injection.
- Alert on new administrator accounts, modified course records, or bulk SELECT operations against the timetabling database.
- Track access patterns to /admin/ paths from unauthenticated or geographically anomalous sources.
How to Mitigate CVE-2026-86221
Immediate Actions Required
- Restrict network exposure of the /admin/ interface to trusted IP ranges or place it behind a VPN.
- Deploy WAF signatures that block SQL injection payloads targeting the course parameter in /admin/modal_add_course1.php.
- Review database and web server logs for prior exploitation attempts and rotate any credentials that may have been exposed.
Patch Information
As of the last NVD update on 2026-09-08, no vendor patch has been referenced. Monitor SourceCodester Security Resources and the VulDB Vulnerability #399374 entry for remediation updates. Until an official patch is available, apply the workarounds below and consider decommissioning production instances.
Workarounds
- Refactor the affected code to use prepared statements with mysqli_prepare and bound parameters instead of mysqli_query string concatenation.
- Apply strict server-side input validation on the course parameter, allowing only expected character sets.
- Enforce least-privilege database accounts so the application user cannot execute schema-modifying or administrative SQL.
- Disable or remove /admin/modal_add_course1.php if the course-add workflow is not required in your deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
