CVE-2026-11483: SourceCodester Class and Exam Timetabling System archive4.php sql injection
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /archive4.php. The manipulation of the argument sy results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Class and Exam Timetabling System /archive4.phpfrom your environment.If the functionality provided by /archive4.php is not required, remove or rename the file from the server to eliminate the vulnerable endpoint. Replace with a secure implementation if needed.
- Configuration
Temporarily configure the web server (Apache/nginx/IIS) to deny requests to /archive4.php or restrict access to a small set of trusted management IPs (e.g., return 403 or use Require ip / allow/deny rules) until a secure code fix is deployed.
web server access to /archive4.php = deny or restrict to trusted IPs - Compensating control
Deploy WAF or intrusion prevention rules to block SQL injection attempts against the application, with specific rules to detect and block malicious input in the 'sy' parameter and requests to /archive4.php. Additionally, restrict application access at the network perimeter to trusted IP ranges where possible.
- Operational
Review web server and database logs for suspicious requests to /archive4.php and for successful exploitation attempts involving the 'sy' parameter. Identify any indicators of compromise and investigate potential data access.
- Operational
Rotate database credentials and any application secrets that may have been exposed if logs or other evidence indicate possible compromise, and after remediation is deployed, invalidate sessions/credentials as appropriate.
- Operational
Remediate the SQL injection in archive4.php by ensuring all database access uses parameterized queries/prepared statements and by validating and sanitizing the 'sy' parameter server-side. Test the fix and deploy to production.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11483?
CVE-2026-11483 has a severity rating of high with a score of 7.3.
How do I fix CVE-2026-11483?
To fix CVE-2026-11483, it is recommended to update the SourceCodester Class and Exam Timetabling System to the latest version that addresses this SQL injection vulnerability.
What type of vulnerability is CVE-2026-11483?
CVE-2026-11483 is an SQL injection vulnerability found in the archive4.php file of the SourceCodester Class and Exam Timetabling System.
Can CVE-2026-11483 be exploited remotely?
Yes, CVE-2026-11483 can be exploited remotely due to its nature as an SQL injection vulnerability.
What system is affected by CVE-2026-11483?
The vulnerability CVE-2026-11483 affects the SourceCodester Class and Exam Timetabling System version 1.0.