CVE-2026-11482: SourceCodester Class and Exam Timetabling System archive5.php sql injection
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /archive5.php. The manipulation of the argument sy leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Class and Exam Timetabling System 1.0from your environment.Uninstall the affected application or remove the /archive5.php file from production systems if the functionality is not required.
- Configuration
Validate and parameterize (use prepared statements) all uses of the 'sy' parameter in /archive5.php to prevent SQL injection. If code changes are not possible immediately, disable or remove the script's handling of the 'sy' parameter.
archive5.php sy parameter input handling = sanitize or disable - Compensating control
Restrict remote access to the application and to /archive5.php (for example by firewall rules, IP allowlists, VPN, or WAF rules) until a code-level fix is implemented.
- Operational
Audit logs and system activity for signs of exploitation, perform incident response if compromise is suspected, and monitor vendor or project channels for an official patch or remediation guidance.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11482?
The severity of CVE-2026-11482 is rated high with a score of 7.3.
How do I fix CVE-2026-11482?
To fix CVE-2026-11482, it is recommended to validate and sanitize user inputs to prevent SQL injection.
What is CVE-2026-11482 about?
CVE-2026-11482 describes a SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System via the file /archive5.php.
Can CVE-2026-11482 be exploited remotely?
Yes, CVE-2026-11482 can be exploited remotely, allowing attackers to manipulate SQL queries.
Is there a known exploit for CVE-2026-11482?
Yes, an exploit for CVE-2026-11482 is publicly available, making it critical to address the vulnerability promptly.