CVE-2026-86298: Class and Exam Timetabling System SQLi

CVE-2026-86298 Overview

CVE-2026-86298 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /delete_subject.php script, where the ID parameter is passed to a database query without proper sanitization. Attackers can manipulate the parameter to inject arbitrary SQL statements. The vulnerability is remotely exploitable and requires no authentication or user interaction. Public exploit details have been released, increasing the risk of opportunistic attacks against exposed instances. The issue is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL commands through the ID parameter of /delete_subject.php, potentially disclosing, modifying, or deleting timetable data.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
The vulnerable endpoint is /delete_subject.php
The injectable parameter is ID

Discovery Timeline

2026-09-07 - CVE-2026-86298 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86298

Vulnerability Analysis

The vulnerability affects the delete_subject.php script bundled with the Class and Exam Timetabling System 1.0. The script accepts an ID value from a request parameter and concatenates it into a SQL statement used to remove subject records. Because the input is not validated or parameterized, an attacker can supply crafted SQL fragments that alter the query logic.

Exploitation is possible over the network without credentials or user interaction. A successful attack can expose row data, tamper with timetable records, or destroy data referenced by other tables. The impact is limited by the application's database privileges, but most reference deployments run with a single high-privilege database account.

Exploit code has been released publicly, and the vulnerability has an EPSS score indicating a low but non-trivial short-term exploitation probability. Systems exposed to the internet should be treated as at-risk.

Root Cause

The root cause is missing input sanitization and the absence of prepared statements in delete_subject.php. The ID argument is concatenated directly into a SQL DELETE statement, allowing attacker-controlled syntax to be interpreted by the database engine. This is a classic injection weakness described by [CWE-74].

Attack Vector

An attacker sends an HTTP request to /delete_subject.php with a manipulated ID parameter containing SQL metacharacters or stacked query fragments. Because the endpoint is reachable remotely and requires no authentication, the attack can be automated against any exposed installation. Details are available in the GitHub Issue Report and the VulDB CVE-2026-86298 entry.

No verified proof-of-concept code is reproduced here. Refer to the referenced advisories for technical details on the payload structure.

Detection Methods for CVE-2026-86298

Indicators of Compromise

HTTP requests targeting /delete_subject.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the ID parameter.
Web server logs showing repeated GET or POST requests to /delete_subject.php from a single source with varying ID values.
Unexpected deletion of subject records or database errors referencing malformed DELETE statements.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns in query parameters passed to PHP endpoints under the timetabling application path.
Enable database query logging and alert on DELETE statements referencing unexpected table joins or subqueries originating from the timetabling application's database user.
Correlate anomalous HTTP 500 responses from /delete_subject.php with source IP behavior to identify probing activity.

Monitoring Recommendations

Monitor outbound connections from the application server for signs of data exfiltration following suspicious requests.
Track authentication and privilege changes on the backend database account used by the application.
Review web access logs daily for requests to delete_subject.php from untrusted networks and preserve them for forensic use.

How to Mitigate CVE-2026-86298

Immediate Actions Required

Restrict access to the Class and Exam Timetabling System to trusted networks or place it behind an authenticated reverse proxy until a fix is applied.
Deploy WAF signatures blocking SQL injection payloads against /delete_subject.php and adjacent PHP endpoints that accept ID parameters.
Audit the application's database account and reduce its privileges to the minimum required for timetable operations.

Patch Information

No official vendor patch has been published for CVE-2026-86298 at the time of NVD publication. Administrators should monitor the SourceCodester Security Blog and the VulDB Vulnerability #399460 tracker for updates. Where source code access is available, replace the vulnerable query in delete_subject.php with a parameterized prepared statement using PDO or MySQLi bindings and validate that ID is a positive integer.

Workarounds

Modify delete_subject.php to cast the ID argument to an integer before use, for example $id = (int)$_REQUEST['ID'];.
Refactor the query to use prepared statements with bound parameters instead of string concatenation.
Disable or remove the delete_subject.php endpoint if the delete functionality is not required in the deployment.

bash

# Example mod_security rule to block SQL metacharacters in the ID parameter
SecRule REQUEST_URI "@contains /delete_subject.php" \
  "chain,phase:2,deny,status:403,id:1026086298,msg:'CVE-2026-86298 SQLi attempt'"
  SecRule ARGS:ID "@rx (?i)(\bunion\b|\bselect\b|--|;|'|\bsleep\s*\()" "t:none,t:urlDecodeUni"