Executive Summary
A second SQL injection vulnerability, CVE-2026-86209, has been disclosed in SourceCodester Class and Exam Timetabling System 1.0, published alongside a near-identical flaw in the same product (CVE-2026-86208). This time the vulnerable code lives in /delete_user.php, where the ID argument is again concatenated into a SQL statement without sanitization. The attack is remotely exploitable, requires no authentication, and public exploit code is already circulating.
CVSS 3.1 Score: 7.3 (High)
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-86209 |
| CVSS 3.1 Score | 7.3 (High) |
| CVSS 4.0 Score | 6.9 (Medium) |
| Type | SQL Injection (CWE-89) |
| Attack Vector | Network — remote, unauthenticated |
| Affected Endpoint | /delete_user.php |
| Affected Parameter | ID |
| Exploit Availability | Public exploit published |
| Assigner | VulDB |
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| SourceCodester Class and Exam Timetabling System | 1.0 | None available |
As with the related delete_teacher.php flaw, no vendor patch currently exists.
Technical Details
delete_user.php is intended to remove a user account identified by its ID. Because the application fails to validate or parameterize that value before it reaches the database, an attacker can substitute SQL syntax for a legitimate ID and manipulate the resulting query.
1. Attacker locates a public-facing deployment of the Timetabling System
2. Attacker sends a crafted ID value to /delete_user.php
3. The unsanitized parameter is executed directly by the DBMS
4. Attacker can enumerate or dump entire tables — student records,
teacher schedules, exam results
5. Depending on DBMS privileges (e.g. MySQL with FILE enabled), the
attacker may read/write files via LOAD_FILE or INTO OUTFILE,
escalating toward full server compromiseImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Data Exfiltration | Dump user credentials and personal records from the database |
| Data Tampering | Delete or modify arbitrary user accounts |
| Privilege Escalation | Potential access to administrator accounts stored in the same table |
| Server Compromise | Possible OS-level file access if DBMS privileges permit it |
RedPacket Security's assessment: this should be "treated as urgent for internet-facing deployments" — the combination of public exploitation material and unauthenticated remote access materially increases the likelihood of opportunistic compromise, even though no active exploitation has yet been confirmed in the wild.
Mitigation
- Restrict access to
/delete_user.phpat the web server or firewall level until remediated. - Rewrite the query to use prepared statements with bound parameters instead of string concatenation.
- Validate the
IDinput server-side, rejecting anything that isn't a positive integer. - Apply WAF rules to catch common SQLi payloads targeting this endpoint.
- Audit the user table for unexpected deletions or modifications.
- Minimize database account privileges for the web application — no
FILEprivilege, no unnecessary grants.
Because this is the second SQL injection disclosed in the same codebase within 24 hours (see also CVE-2026-86208), administrators running this software should assume other unaudited endpoints in the same application likely share the same pattern and should be reviewed proactively.
Detection Indicators
| Indicator | Description |
|---|---|
Requests to /delete_user.php with non-numeric ID values | Likely exploitation attempts |
SQL syntax fragments (UNION, SELECT, --, ') in logs for this endpoint | Injection probing |
| Unexpected deletions in the user table | Possible successful exploitation |