Executive Summary
CVE-2026-86220 is an unauthenticated SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0, affecting the mysqli_query call in /admin/modal_add_course.php. The course argument is passed straight into a SQL statement without sanitization, letting a remote, unauthenticated attacker manipulate the query. Public exploit code is already available.
CVSS 3.1 Score: 7.3 (High)
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-86220 |
| CVSS 3.1 Score | 7.3 (High) |
| CVSS 4.0 Score | 6.9 (Medium) |
| Type | SQL Injection (CWE-89) |
| Attack Vector | Network — remote, unauthenticated |
| Affected Endpoint | /admin/modal_add_course.php |
| Affected Parameter | course |
| Exploit Availability | Public exploit published |
| Assigner | VulDB |
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| SourceCodester Class and Exam Timetabling System | 1.0 | None available |
No vendor patch currently exists for this codebase.
Technical Details
modal_add_course.php is intended to insert a new course record via an admin-facing modal form. The course parameter is concatenated directly into the SQL query passed to mysqli_query, without parameterization or input validation. An attacker who can reach this endpoint — no authentication required — can substitute SQL syntax for the expected course name and alter the query's behavior.
1. Attacker locates a public-facing deployment of the Timetabling System
2. Attacker sends a crafted "course" value to /admin/modal_add_course.php
3. The unsanitized parameter is executed directly by the DBMS
4. Attacker can enumerate or dump entire tables — student records,
course catalogs, admin credentials
5. Depending on DBMS privileges (e.g. MySQL with FILE enabled), the
attacker may read/write files via LOAD_FILE or INTO OUTFILE,
escalating toward full server compromiseOne analysis characterizes exploitation as pre-auth time-based blind SQL injection, meaning an attacker doesn't need visible query output — timing differences in server responses are enough to extract data byte by byte.
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Data Exfiltration | Dump course, student, and administrator records from the database |
| Data Tampering | Insert or modify arbitrary course entries |
| Privilege Escalation | Potential access to administrator credentials stored in the same database |
| Server Compromise | Possible OS-level file access if DBMS privileges permit it |
Mitigation
- Restrict access to
/admin/modal_add_course.phpat the web server or firewall level until remediated. - Rewrite the query to use prepared statements with bound parameters instead of string concatenation.
- Validate the
courseinput server-side, rejecting unexpected characters and enforcing a strict format. - Apply WAF rules to catch common SQLi payloads, including time-based blind injection patterns, targeting this endpoint.
- Audit the course table for unexpected inserts or modifications.
- Minimize database account privileges for the web application — no
FILEprivilege, no unnecessary grants.
This is one of several near-identical SQL injection disclosures found across /admin/modal_add_*.php and delete_*.php endpoints in this same codebase over the past few weeks. Administrators running this software should assume other unaudited endpoints likely share the same pattern and review the entire admin panel proactively rather than patching endpoint by endpoint.
Detection Indicators
| Indicator | Description |
|---|---|
Requests to /admin/modal_add_course.php with SQL syntax in the course field | Likely exploitation attempts |
SQL syntax fragments (UNION, SELECT, SLEEP, --, ') in logs for this endpoint | Injection probing, including time-based blind techniques |
| Unusually slow response times on this endpoint | Possible time-based blind SQLi in progress |
| Unexpected inserts in the course table | Possible successful exploitation |