CVE-2026-86223: Class and Exam Timetabling System SQLi

CVE-2026-86223 Overview

CVE-2026-86223 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the mysqli_query function call within /admin/modal_add_coursea.php. Attackers can manipulate the course argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable without authentication or user interaction, and a public exploit has been disclosed.

The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Successful exploitation can lead to unauthorized database access, data disclosure, and manipulation of course and scheduling records.

Critical Impact
Remote unauthenticated attackers can inject SQL statements through the course parameter, exposing or altering data stored in the timetabling database.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Component: /admin/modal_add_coursea.php
Vulnerable function: mysqli_query invocation on the course parameter

Discovery Timeline

2026-09-06 - CVE-2026-86223 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86223

Vulnerability Analysis

The vulnerability exists in the administrative endpoint /admin/modal_add_coursea.php of the Class and Exam Timetabling System. The application passes the course request parameter directly into a mysqli_query call without parameterization or input sanitization. This allows an attacker to break out of the intended query context and append arbitrary SQL syntax.

Because the endpoint is reachable over the network and does not enforce authentication controls that block the injection, exploitation requires only a crafted HTTP request. The Exploit Prediction Scoring System (EPSS) currently reports a low probability of near-term mass exploitation, but a public proof-of-concept lowers the barrier for opportunistic attackers.

Root Cause

The root cause is missing input neutralization on the course parameter before it is concatenated into a SQL statement executed via mysqli_query. The code does not use prepared statements or parameter binding, and it does not validate the type or content of the input. This is a textbook SQL injection weakness aligned with [CWE-74].

Attack Vector

An unauthenticated remote attacker sends an HTTP request to /admin/modal_add_coursea.php containing a crafted course parameter value. The payload closes the intended string literal and appends attacker-controlled SQL, such as UNION SELECT clauses to exfiltrate data or boolean-based conditions to enumerate schema. See the GitHub issue tracker and the VulDB vulnerability details for additional technical context.

No verified exploit code is republished here. Refer to the VulDB CTI analysis for further indicators.

Detection Methods for CVE-2026-86223

Indicators of Compromise

HTTP requests to /admin/modal_add_coursea.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in the course parameter.
Web server or PHP error logs referencing mysqli_query failures or SQL syntax errors originating from the timetabling admin endpoint.
Unexpected outbound database queries, schema enumeration activity, or dumps of tables unrelated to course creation.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST and GET parameters submitted to the timetabling admin path for SQL injection signatures.
Enable database query logging and alert on parameterized queries returning unexpectedly large result sets or accessing sensitive tables from the timetabling application context.
Correlate anomalous administrative access patterns with source IP reputation to surface reconnaissance attempts against the public PoC.

Monitoring Recommendations

Monitor authentication and access logs for repeated requests targeting /admin/modal_add_coursea.php from a single source.
Ingest web server, PHP, and MySQL logs into a centralized analytics platform to correlate injection attempts with backend query anomalies.
Baseline normal administrative traffic volumes and alert on deviations that align with automated SQL injection tooling.

How to Mitigate CVE-2026-86223

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting, VPN, or authenticated reverse proxy controls until a patch is available.
Deploy WAF signatures that block SQL injection patterns targeting the course parameter of modal_add_coursea.php.
Audit the application database account and remove privileges not required for normal timetabling operations to limit blast radius.

Patch Information

No vendor patch has been published in the referenced advisories at the time of writing. Monitor the SourceCodester site and the VulDB CVE entry for updates. Organizations maintaining custom forks should refactor the affected code path to use prepared statements with bound parameters and strict input validation on the course field.

Workarounds

Disable or remove the modal_add_coursea.php endpoint if course addition is not actively used.
Apply a virtual patch at the WAF layer to reject requests containing SQL metacharacters in the course parameter.
Enforce least-privilege database credentials so the web application cannot access or modify tables outside its required scope.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /admin/modal_add_coursea.php" \
  "phase:2,chain,deny,status:403,id:1026086223,\
  msg:'Potential SQLi against CVE-2026-86223'"
  SecRule ARGS:course "@rx (?i)(union(\s|/\*.*\*/)+select|--|;|/\*|xp_|information_schema)" \
    "t:none,t:urlDecodeUni"