CVE-2026-86222: Class and Exam Timetabling System SQL Injection

CVE-2026-86222 Overview

CVE-2026-86222 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the mysqli_query function call within /admin/modal_add_course2.php. Attackers can manipulate the course parameter to inject arbitrary SQL statements into the underlying database query. The vulnerability is remotely exploitable and requires no authentication or user interaction. Public disclosure of the exploit has occurred, increasing the risk of opportunistic attacks against exposed installations. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL through the course parameter, potentially exposing or modifying database contents.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Component: /admin/modal_add_course2.php
Vulnerable function: mysqli_query with unsanitized course argument

Discovery Timeline

2026-09-06 - CVE-2026-86222 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86222

Vulnerability Analysis

The vulnerability exists in the administrative course-addition workflow of the Class and Exam Timetabling System. The script /admin/modal_add_course2.php receives a user-supplied course parameter and passes it directly into a mysqli_query call without parameterization or input sanitization. An attacker can inject arbitrary SQL syntax to alter the intended query structure.

Successful exploitation permits data exfiltration, modification, or deletion within the application database. Depending on database privileges, attackers may enumerate schema information, extract credentials, or manipulate timetabling records. The exploit code has been disclosed publicly, lowering the barrier to attack.

Root Cause

The root cause is improper neutralization of special elements in a downstream SQL component [CWE-74]. Input from the course request parameter is concatenated into an SQL statement rather than bound as a parameter. This allows syntactic breakout characters such as single quotes and SQL keywords to alter query semantics.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction in the affected code path. An attacker sends a crafted HTTP request to /admin/modal_add_course2.php with malicious SQL payloads in the course parameter. Refer to the GitHub CVE Issue Discussion and the VulDB Vulnerability Record #399375 for additional technical context.

Detection Methods for CVE-2026-86222

Indicators of Compromise

HTTP requests to /admin/modal_add_course2.php containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP( in the course parameter.
Unexpected database error messages in application logs referencing syntax errors near the course value.
Anomalous outbound queries or spikes in database read volume originating from the timetabling application.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST and GET parameters submitted to /admin/modal_add_course2.php for SQL injection signatures.
Enable MySQL general query logging temporarily to identify queries containing unexpected control tokens sourced from the course field.
Correlate authentication logs with administrative endpoint access to identify unauthenticated hits to /admin/ paths.

Monitoring Recommendations

Alert on HTTP 500 responses returned from /admin/modal_add_course2.php, which often accompany failed injection attempts.
Monitor database user activity for schema enumeration queries against information_schema.
Track repeated requests from single source addresses targeting administrative PHP endpoints.

How to Mitigate CVE-2026-86222

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlists or authentication proxies until a patched build is available.
Audit the application database for signs of unauthorized modification, added accounts, or unexpected records.
Rotate database credentials used by the application if exploitation is suspected.

Patch Information

No vendor patch has been published at the time of writing. SourceCodester has not released an updated version addressing CVE-2026-86222. Monitor the SourceCodester Security Blog and the VulDB CVE Record #CVE-2026-86222 for advisory updates.

Workarounds

Modify /admin/modal_add_course2.php to use prepared statements with bound parameters instead of concatenating course into the query string.
Add server-side input validation that rejects non-alphanumeric characters in the course parameter.
Place the application behind a WAF configured with SQL injection rule sets such as OWASP Core Rule Set.
Consider retiring or replacing the application if it is exposed to untrusted networks and no patch is forthcoming.

bash

# Example: block requests containing common SQLi tokens targeting the vulnerable endpoint
# ModSecurity rule (illustrative)
SecRule REQUEST_URI "@contains /admin/modal_add_course2.php" \
  "chain,phase:2,deny,status:403,id:1026086222,msg:'Potential SQLi in course parameter'"
  SecRule ARGS:course "@rx (?i)(union(\s|/\*.*\*/)+select|--|\bor\b\s+\d+=\d+|sleep\s*\()" "t:none"