Third SourceCodester Timetabling SQLi Hits the Admin Product Form

Executive Summary

A third SQL injection vulnerability, CVE-2026-86224, has been disclosed in SourceCodester Class and Exam Timetabling System 1.0, following two related flaws published in the same product line (CVE-2026-86208 and CVE-2026-86209). This time the vulnerable code lives in /admin/modal_add_product.php, where the fname POST parameter is concatenated directly into a mysqli_query() call without sanitization. A proof of concept has confirmed the flaw is exploitable pre-authentication, and public exploit code is already circulating.

CVSS 3.1 Score: 7.3 (High)

Vulnerability Overview

Affected Versions

As with the two related flaws in this codebase, no vendor patch currently exists.

Technical Details

admin/modal_add_product.php accepts a POST request carrying fname, lname, arank, designation, department, and go — used to add a staff record from the admin panel. Around line 59 the fname value is read from $_POST and, around lines 65–66, concatenated directly into a mysqli_query() call with no escaping, parameterization, or type validation.

1. Attacker sends a crafted POST request to /admin/modal_add_product.php
2. The request includes a malicious `fname` value and does NOT require
   a valid session cookie — the endpoint fails to enforce authentication
3. The unsanitized parameter reaches mysqli_query() unmodified
4. A quoted payload returns HTTP 200 with visible SQL error output,
   confirming injection
5. A time-based blind technique (fname=' OR SLEEP(5)-- -) was confirmed
   via sqlmap, allowing full database enumeration without ever seeing
   query output directly

Pre-Authentication Confirmation

Testing against a local Docker deployment showed the endpoint returns a valid response and SQL error output for a quoted fname payload without sending any authenticated session cookie — meaning the admin-panel form is reachable and injectable by an anonymous, unauthenticated attacker despite living under /admin/.

Impact of Successful Exploitation

Mitigation

1. Restrict access to /admin/modal_add_product.php at the web server or firewall level until remediated.
2. Rewrite the query to use prepared statements with bound parameters instead of string concatenation.
3. Enforce session authentication server-side on every /admin/ endpoint — the fact this form ran without a valid session is a separate access-control defect worth auditing.
4. Validate all POST fields (fname, lname, arank, designation, department) server-side, rejecting unexpected characters.
5. Apply WAF rules to catch time-based blind SQLi patterns (SLEEP(, BENCHMARK(, OR 1=1) targeting this endpoint.
6. Minimize database account privileges for the web application — no FILE privilege, no unnecessary grants.

This is the third SQL injection disclosed in this codebase in roughly a week (see also CVE-2026-86208 and CVE-2026-86209), with related reports for additional modal_add_*.php endpoints also under review by the same researcher. Administrators running this software should treat every endpoint under /admin/modal_add_*.php as unaudited and likely vulnerable until proven otherwise.

Detection Indicators

References

• VulDB — CVE-2026-86224
• OffSeq Threat Radar — CVE-2026-86224
• NIST NVD — CVE-2026-86224

Related Reading

• Second SQL Injection Hits SourceCodester Timetabling System
• SQL Injection in SourceCodester Class & Exam Timetabling System
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+