CVE-2026-11472: SourceCodester Class and Exam Timetabling System index1.php sql injection
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /index1.php. This manipulation of the argument Password causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Class and Exam Timetabling Systemfrom your environment.If the application is not required, uninstall or disable it until code fixes are implemented to eliminate the SQL injection vulnerability in /index1.php.
- Configuration
Change the code in /index1.php so the 'Password' parameter is never concatenated into SQL. Use prepared statements/parameterized queries for all database access, enforce strict input validation (length and allowed characters) and apply proper output encoding.
SourceCodester Class and Exam Timetabling System (/index1.php) Password parameter handling = use parameterized queries and validate input - Compensating control
Deploy a Web Application Firewall (WAF) or intrusion prevention rule to block SQL injection attempts targeting /index1.php and the 'Password' parameter, and apply network ACLs to restrict access to the application to trusted IPs where feasible.
- Operational
Assume potential compromise: review application and database logs for suspicious activity against /index1.php, and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11472?
The severity of CVE-2026-11472 is classified as high with a score of 7.3.
How do I fix CVE-2026-11472?
To fix CVE-2026-11472, you should implement prepared statements and parameterized queries to prevent SQL injection.
What type of vulnerability is CVE-2026-11472?
CVE-2026-11472 is classified as an SQL Injection vulnerability.
Can CVE-2026-11472 be exploited remotely?
Yes, CVE-2026-11472 can be exploited remotely by manipulating the Password argument.
Which file is affected by CVE-2026-11472?
The affected file in CVE-2026-11472 is /index1.php in the SourceCodester Class and Exam Timetabling System.