Executive Summary
A SQL injection vulnerability tracked as CVE-2026-86208 has been disclosed in SourceCodester Class and Exam Timetabling System 1.0, a free PHP/MySQL scheduling application widely reused in student projects and small deployments. The flaw sits in an unknown function of /delete_teacher.php, where the ID argument is passed into a database query without sanitization. The attack can be launched remotely and requires no authentication. Public exploit code is already available.
CVSS 3.1 Score: 7.3 (High)
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-86208 |
| CVSS 3.1 Score | 7.3 (High) |
| CVSS 4.0 Score | 6.9 (Medium) |
| Type | SQL Injection (CWE-89) |
| Attack Vector | Network — remote, unauthenticated |
| Affected Endpoint | /delete_teacher.php |
| Affected Parameter | ID |
| Exploit Availability | Public exploit published |
| Assigner | VulDB |
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| SourceCodester Class and Exam Timetabling System | 1.0 | None available |
No vendor patch has been released for this issue as of publication. SourceCodester projects are community-maintained sample applications; fixes, if any, typically arrive as unofficial community patches rather than an official release.
Technical Details
delete_teacher.php accepts an ID value — most likely via a GET or POST request — and concatenates it directly into a SQL statement used to delete a teacher record. Because the value is not validated or passed through a parameterized query, an attacker can inject arbitrary SQL syntax in place of a legitimate numeric ID.
1. Attacker identifies a public-facing deployment of the Timetabling System
2. Attacker crafts a malicious ID value for /delete_teacher.php,
e.g. injecting UNION SELECT or boolean-based payloads
3. The unsanitized value reaches the SQL query and is executed by MySQL
4. Attacker extracts, modifies, or deletes arbitrary database records
5. Depending on DB privileges, further compromise (e.g. via
INTO OUTFILE / LOAD_FILE) may be possibleImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Data Exfiltration | Dump student, teacher, and exam schedule records |
| Data Tampering | Modify or delete arbitrary rows via injected statements |
| Authentication Bypass | Potential to bypass login logic if credentials share the same database |
| Server Compromise | Possible file read/write via DBMS functions if privileges allow it |
Mitigation
Because no official fix currently exists, treat this as an urgent, unpatched issue for any internet-facing instance.
- Take the endpoint offline — restrict or disable public access to
/delete_teacher.phpat the web server or firewall level until it can be remediated. - Patch the source directly — refactor the delete-teacher query to use parameterized statements / prepared queries instead of string concatenation.
- Validate input — reject any
IDvalue that is not a positive integer before it reaches the database layer. - Deploy a WAF rule to detect and block common SQL injection payloads targeting this endpoint.
- Review database logs for suspicious queries against the teacher table.
- Restrict database privileges for the application account — it should not have
FILEprivileges or the ability to read/write arbitrary paths.
Detection Indicators
| Indicator | Description |
|---|---|
Requests to /delete_teacher.php with non-numeric ID values | Likely exploitation attempts |
SQL syntax fragments (UNION, SELECT, --, ') in access logs for this endpoint | Injection probing |
| Unexpected deletions in the teacher table | Possible successful exploitation |