CVE-2026-86225 Overview
CVE-2026-86225 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the mysqli_query call within /admin/modal_add_room.php, where the room_name parameter is passed to the database layer without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements against the backing database. The vulnerability is remotely exploitable over the network, and public exploit details have been published. The issue is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).
Critical Impact
Remote attackers can inject SQL into the room_name parameter of /admin/modal_add_room.php, exposing the underlying database to unauthorized read, modification, or deletion of records.
Affected Products
- SourceCodester Class and Exam Timetabling System 1.0
- Component: /admin/modal_add_room.php
- Vulnerable function: mysqli_query with untrusted room_name argument
Discovery Timeline
- 2026-09-06 - CVE-2026-86225 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86225
Vulnerability Analysis
The defect is a classic first-order SQL injection in an administrative endpoint of the Class and Exam Timetabling System. When an administrator submits the add-room modal, the application forwards the room_name value into a mysqli_query call that concatenates the input directly into an SQL statement. Because the code neither uses prepared statements nor escapes input with mysqli_real_escape_string, an attacker who can reach /admin/modal_add_room.php can alter query semantics. Depending on the deployment, this may allow record extraction, authentication data theft, or destructive statements against the timetabling database.
Root Cause
The root cause is missing input neutralization on the room_name HTTP parameter before it is embedded in a dynamic SQL string. PHP's mysqli_query executes whatever SQL it receives, so any attacker-controlled quote character, comment sequence, or UNION clause changes the query the database ultimately executes. This pattern matches CWE-74 and its child CWE-89 (SQL Injection). Additional details are tracked in the public GitHub issue and the VulDB advisory.
Attack Vector
Exploitation requires network access to the vulnerable admin endpoint and a crafted HTTP request containing malicious SQL syntax in the room_name field. According to the advisory, no user interaction is required beyond issuing the request, and the exploit has been publicly disclosed. The EPSS score of 0.263% suggests limited but non-trivial predicted exploitation activity in the short term.
No verified proof-of-concept code is reproduced here. Refer to the VulDB entry for technical exploitation notes.
Detection Methods for CVE-2026-86225
Indicators of Compromise
- HTTP POST or GET requests to /admin/modal_add_room.php containing SQL metacharacters in room_name, such as single quotes, --, /*, UNION SELECT, or SLEEP(.
- Unexpected database errors or MySQL warnings in application logs correlated with requests to the modal_add_room.php endpoint.
- New or modified rows in administrative tables (users, sessions, rooms) that do not correspond to legitimate admin activity.
Detection Strategies
- Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting /admin/modal_add_room.php request parameters.
- Enable MySQL general query logging temporarily to correlate suspicious queries with source IP addresses hitting the admin console.
- Review reverse-proxy logs for requests to modal_add_room.php originating from unauthenticated or unexpected sources.
Monitoring Recommendations
- Alert on repeated 500-series responses from the admin path, which often signal injection probing.
- Monitor for outbound data spikes from the database host that could indicate mass extraction via UNION-based injection.
- Track administrative session creation and privilege changes in the timetabling database schema.
How to Mitigate CVE-2026-86225
Immediate Actions Required
- Restrict network access to /admin/ paths using IP allowlists, VPN, or reverse-proxy authentication until a patched build is deployed.
- Rotate database credentials and any administrator passwords stored in the affected database.
- Audit recent database activity for unauthorized INSERT, UPDATE, or DELETE operations against room and user tables.
Patch Information
No official vendor patch has been referenced in the advisory for SourceCodester Class and Exam Timetabling System 1.0. Operators should monitor the SourceCodester site and the VulDB record for updates. In the interim, modify /admin/modal_add_room.php to use parameterized queries via mysqli_prepare and bind_param, or apply mysqli_real_escape_string to every user-supplied value before it reaches mysqli_query.
Workarounds
- Replace concatenated SQL in modal_add_room.php with prepared statements binding room_name as a string parameter.
- Add server-side input validation that rejects room_name values containing SQL metacharacters or exceeding expected length.
- Place the application behind a WAF configured with OWASP Core Rule Set SQL injection signatures, in blocking mode for the /admin/ path.
- Enforce least-privilege database accounts so the web application cannot execute DROP, ALTER, or cross-database queries.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
