CVE-2026-11485: SourceCodester Class and Exam Timetabling System archive2.php sql injection
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive2.php. Such manipulation of the argument sy leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Class and Exam Timetabling System /archive2.phpfrom your environment.Remove or disable the vulnerable /archive2.php endpoint if it is not required. If the endpoint must remain, restrict access until a code fix is applied.
- Configuration
Sanitize and validate the 'sy' parameter and change database access to use prepared statements/parameterized queries (or strict whitelist/typed validation) to eliminate SQL injection. Ensure any user-supplied input is constrained to expected values or types.
SourceCodester Class and Exam Timetabling System (/archive2.php) parameter 'sy' input handling = validate and use parameterized queries - Compensating control
Apply compensating controls while code is fixed: block or rate-limit requests to /archive2.php with a web application firewall or reverse proxy, add firewall rules to restrict access to the endpoint to trusted IPs, and create WAF signatures to detect and block SQL injection attempts targeting the 'sy' parameter.
- Operational
Assume possible exploitation given public disclosure: review web and database logs for evidence of attacks against /archive2.php and the 'sy' parameter, investigate and remediate any suspicious activity, rotate any credentials or secrets that may have been exposed, and restore affected systems from known-good backups if compromise is confirmed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11485?
CVE-2026-11485 has a severity score of 7.3, classifying it as high risk.
How do I fix CVE-2026-11485?
To fix CVE-2026-11485, update the SourceCodester Class and Exam Timetabling System to the latest version which addresses this SQL injection vulnerability.
What type of vulnerability is CVE-2026-11485?
CVE-2026-11485 is classified as an SQL injection vulnerability affecting the /archive2.php file.
Can CVE-2026-11485 be exploited remotely?
Yes, CVE-2026-11485 can be exploited remotely as it allows manipulation of parameters that lead to SQL injection.
What functions are affected by CVE-2026-11485?
CVE-2026-11485 affects an unknown function within the /archive2.php file of the SourceCodester Class and Exam Timetabling System.