CVE-2026-11484: SourceCodester Class and Exam Timetabling System archive3.php sql injection
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /archive3.php. This manipulation of the argument sy causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Class and Exam Timetabling System 1.0from your environment.If an immediate fix or mitigation is not possible, uninstall or take the affected application offline to eliminate exposure to the vulnerability.
- Configuration
Modify the application code in /archive3.php to prevent SQL injection: validate or whitelist the 'sy' parameter and use parameterized/prepared statements (or equivalent parameter binding) for all database queries.
archive3.php (SourceCodester Class and Exam Timetabling System 1.0) input_handling for 'sy' parameter = use parameterized/prepared statements and strict input validation/whitelisting - Configuration
Disable or restrict access to the /archive3.php endpoint (for example via web server configuration, application routing, or feature toggle) until a secure code fix is applied.
Web server / application routing access to /archive3.php = disabled or restricted - Compensating control
Deploy a WAF or firewall rule to block or inspect requests to /archive3.php and specifically the 'sy' parameter; filter or block request patterns indicative of SQL injection to reduce exposure until the application is fixed.
- Operational
Audit web and database logs for evidence of exploitation targeting /archive3.php and the 'sy' parameter. If compromise is suspected, rotate any potentially exposed credentials, secrets or keys and follow incident response procedures (containment, eradication, recovery).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11484?
The severity of CVE-2026-11484 is rated high, with a score of 7.3.
What type of vulnerability is CVE-2026-11484?
CVE-2026-11484 is identified as an SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System.
How do I fix CVE-2026-11484?
To fix CVE-2026-11484, sanitize and parameterize all SQL queries in the affected /archive3.php file.
What impact does CVE-2026-11484 have on my system?
CVE-2026-11484 can allow remote attackers to execute arbitrary SQL commands, potentially compromising the database.
Is there a public exploit available for CVE-2026-11484?
Yes, an exploit for CVE-2026-11484 has been made publicly available.