SQL Injection Vulnerabilities in Class and Exam Timetabling System

Two SQL injection vulnerabilities were discovered in the 'Class and Exam Timetabling System'. The first is in the '/modal_add_product.php' file, allowing attackers to exploit the 'fname' parameter for unauthorized database access. The second vulnerability is in the '/modal_add_room.php' file, where the 'room_name' parameter is similarly vulnerable. Both vulnerabilities stem from insufficient input validation, enabling attackers to manipulate SQL queries. The potential impact includes unauthorized access to sensitive data, data tampering, and service interruptions. Immediate remedial measures are recommended to protect system integrity. Tools like sqlmap were used to demonstrate the vulnerabilities. Both issues were reported on September 7, 2026.

Key Points: • Two SQL injection vulnerabilities identified in the same project. • Insufficient input validation allows for unauthorized database access. • Immediate remediation is necessary to protect sensitive data.