CVE-2026-11486: SourceCodester Class and Exam Timetabling System archive1.php sql injection
A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /archive1.php. Performing a manipulation of the argument sy results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Class and Exam Timetabling System 1.0from your environment.If the application is not required, uninstall/remove SourceCodester Class and Exam Timetabling System 1.0 to eliminate the vulnerable component (/archive1.php).
- Configuration
Immediately disable or remove public access to /archive1.php (e.g., remove the file, restrict via webserver configuration, or deny requests) until a proper code fix is applied.
SourceCodester Class and Exam Timetabling System 1.0 (/archive1.php) archive1.php access = disabled - Configuration
Fix the /archive1.php source code to prevent SQL injection on the 'sy' parameter: apply strict input validation and use parameterized/prepared statements (or stored procedures) instead of concatenating 'sy' into SQL queries.
SourceCodester Class and Exam Timetabling System 1.0 (/archive1.php) input_validation(sy) = use parameterized queries / strict validation - Compensating control
Deploy a WAF rule or webserver filtering to block SQL injection attempts targeting the 'sy' parameter and/or restrict access to the affected endpoint to trusted IPs until the code is fixed.
- Operational
Assume potential exploitation given public exploit availability: review webserver and application logs for suspicious requests to /archive1.php, investigate for signs of compromise, and rotate any credentials or secrets that may have been exposed if compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11486?
CVE-2026-11486 has a severity rating of high with a score of 7.3.
What type of vulnerability is CVE-2026-11486?
CVE-2026-11486 is classified as an SQL Injection vulnerability.
How do I fix CVE-2026-11486?
To fix CVE-2026-11486, sanitize and validate the input parameters for the /archive1.php file to prevent SQL injection.
Is remote exploitation possible with CVE-2026-11486?
Yes, CVE-2026-11486 allows for remote exploitation due to its SQL injection nature.
Which software is affected by CVE-2026-11486?
The vulnerability CVE-2026-11486 affects the SourceCodester Class and Exam Timetabling System version 1.0.