CVE Alert: CVE-2026-86225 – SourceCodester

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqli_query of the file /admin/modal_add_room.php. The manipulation of the argument room_name leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

This warrants prompt remediation because exploitation is low-friction and publicly available, although KEV status, SSVC exploitation state and EPSS probability are not provided.

An unauthenticated attacker may be able to alter or extract timetable-related data, disrupt room allocation, or use the application as an entry point for further compromise. Even where direct impact is limited, manipulated scheduling data can affect teaching, examinations and operational coordination. Public exploit availability increases the likelihood of opportunistic scanning against exposed installations.

### Most likely attack path

The likely path is a remote request to the affected administrative function, requiring no prior account, user interaction or unusual conditions. The absence of scope change suggests impact is initially confined to the application and its database, but database access could expose credentials or sensitive records that enable subsequent movement. The supplied scoring indicates low attack complexity and no meaningful precondition beyond network reachability.

### Who is most exposed

Schools, colleges and small organisations running this freeware application on internet-facing hosting are most exposed, particularly where the administrative area is directly reachable or deployed alongside other services. Unmaintained copied or customised installations may be difficult to identify and patch consistently.

Alert on unusual requests to the room-management endpoint, especially encoded quotes, or SQL operators.

Review web, reverse-proxy and database logs for anomalous parameters and database errors.

Check for unexpected timetable, room or account changes.

Hunt for new database users, altered privileges or outbound connections from the web host.

### Mitigation and prioritisation

Apply a vendor fix or remove the affected component; absent a fix, plan replacement rather than relying on source edits.

Restrict administrative access through VPN, allow-listing or an authenticated reverse proxy.

Deploy tuned WAF rules and parameterised-query protections as interim controls.

Preserve logs and test changes in a staging copy before production deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.