CVE-2026-86224: Class and Exam Timetabling System SQLi

CVE-2026-86224 Overview

CVE-2026-86224 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the mysqli_query function call within /admin/modal_add_product.php, where the fname argument is passed to the database without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network without authentication or user interaction. Public disclosure of the exploit technique has occurred, increasing the likelihood of opportunistic exploitation against exposed installations. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL through the fname parameter, potentially reading, modifying, or destroying database contents in the affected admin module.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Component: /admin/modal_add_product.php
Vulnerable function: mysqli_query processing the fname argument

Discovery Timeline

2026-09-06 - CVE-2026-86224 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86224

Vulnerability Analysis

The vulnerability exists in the admin-side product modal handler at /admin/modal_add_product.php. The application accepts the fname input parameter and concatenates it directly into a SQL statement executed by mysqli_query. Because the input is not parameterized or escaped, an attacker controls the structure of the resulting query. This allows classic SQL injection payloads that alter query logic, enumerate schema data, or extract records from the underlying MySQL database. Public disclosure of the exploit means proof-of-concept payloads are available to unskilled attackers. According to EPSS data dated 2026-09-11, the probability of exploitation activity is 0.269%.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a downstream SQL interpreter [CWE-74]. The fname argument reaches mysqli_query without prepared statements or input validation. This design flaw is common in legacy PHP applications that use string concatenation to build queries rather than parameter binding with mysqli_prepare or PDO equivalents.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to /admin/modal_add_product.php with a malicious fname value. The payload closes the intended SQL literal and appends attacker-controlled clauses such as UNION SELECT statements or boolean-based extraction primitives. Successful exploitation yields read or write access to the timetabling database, which typically stores administrative credentials, class schedules, and user records.

No verified proof-of-concept code is reproduced here. Technical details are available in the GitHub Issue Discussion and the VulDB Vulnerability Details entry.

Detection Methods for CVE-2026-86224

Indicators of Compromise

HTTP requests to /admin/modal_add_product.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, /*, or SLEEP( in the fname parameter.
Unexpected MySQL error messages referencing the fname field in web server or PHP error logs.
Anomalous outbound database responses with unusually large payload sizes to the admin module.
Creation, modification, or deletion of records in database tables tied to product or timetabling data without corresponding admin activity.

Detection Strategies

Deploy web application firewall rules that inspect POST and GET parameters submitted to /admin/modal_add_product.php for SQL injection signatures.
Enable MySQL general query logging temporarily and audit for queries containing tautologies such as OR 1=1 originating from the timetabling application.
Correlate web access logs with database logs to identify request-response pairs indicative of union-based or time-based blind injection.

Monitoring Recommendations

Alert on repeated 500 responses from the admin endpoint, which frequently indicate injection probing.
Monitor for authentication anomalies on admin accounts following suspicious requests to the vulnerable path.
Track outbound network flows from the web server to detect data staging or exfiltration attempts.

How to Mitigate CVE-2026-86224

Immediate Actions Required

Restrict network access to /admin/ paths using IP allowlists or VPN gating until a patched build is applied.
Deploy WAF rules that block SQL metacharacters in the fname parameter of the affected endpoint.
Rotate all database credentials and admin passwords if evidence of exploitation exists.
Audit the database for unauthorized modifications, new administrative accounts, or exfiltration indicators.

Patch Information

No official vendor patch has been published at the time of NVD disclosure. Consult the SourceCodester Security Resources portal and the VulDB CVE Database Entry for updates. Organizations should consider replacing the vulnerable installation or applying source-level fixes that convert the affected query to a parameterized statement using mysqli_prepare with bound parameters.

Workarounds

Modify /admin/modal_add_product.php to use prepared statements and bind the fname parameter with type-specified placeholders.
Apply server-side input validation that rejects non-alphanumeric characters in fname where the field represents a name.
Enforce least-privilege database accounts so the application user cannot execute DROP, ALTER, or cross-database queries.
Isolate the timetabling application on a network segment with restricted egress until remediation is verified.

bash

# Example ModSecurity rule to block SQL metacharacters in the fname parameter
SecRule ARGS:fname "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|'|\bor\b\s+1=1)" \
    "id:1026862240,phase:2,deny,status:403,log,\
    msg:'CVE-2026-86224 SQL Injection attempt on modal_add_product.php'"