CVE-2026-11471: SourceCodester Class and Exam Timetabling System index2.php sql injection
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /index2.php. The manipulation of the argument Password results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Class and Exam Timetabling System/index2.phpfrom your environment.If index2.php (the vulnerable endpoint) is not required for application functionality, remove or disable the file on the web server to eliminate the vulnerable endpoint.
- Configuration
Modify index2.php so any database access that uses the Password parameter uses parameterized queries (prepared statements) and implement proper input validation/whitelisting and escaping to prevent SQL injection.
SourceCodester Class and Exam Timetabling System (index2.php) Password parameter handling = use prepared statements and input validation - Compensating control
Restrict access to the application or the index2.php endpoint to trusted IPs using network/firewall rules or web-server access controls, and deploy a Web Application Firewall (WAF) with rules to detect and block SQL injection attempts.
- Operational
Review server and application logs for indicators of exploitation; if any compromise is suspected, rotate potentially exposed credentials and secrets and perform an incident investigation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11471?
The severity of CVE-2026-11471 is categorized as high with a score of 7.3.
How does CVE-2026-11471 impact the system?
CVE-2026-11471 allows for SQL injection through the manipulation of the Password argument in the file index2.php.
Can CVE-2026-11471 be exploited remotely?
Yes, CVE-2026-11471 can be exploited remotely.
What versions are affected by CVE-2026-11471?
CVE-2026-11471 affects version 1.0 of the SourceCodester Class and Exam Timetabling System.
What is the recommended mitigation for CVE-2026-11471?
To mitigate CVE-2026-11471, it is recommended to validate and sanitize user inputs to prevent SQL injection.