CVE-2026-85512
Deferred Deferred - Pending Action

Missing Authorization in Class and Exam Timetabling System

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-24
AI Q&A
2026-09-04
EPSS Evaluated
2026-09-23
NVD
CVE-2026-85512
EUVD
EUVD-2026-70995

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sourcecodester class_and_exam_timetabling_system 1.0
sourcecodester class_and_exam_timetabling_system From 1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85512 is a security flaw in SourceCodester Class and Exam Timetabling System 1.0. It involves a missing authorization issue in the file /admin/session.php where the manipulation of the ID argument allows remote attackers to bypass access controls. An exploit has been publicly released.

Detection Guidance

To detect this SQL injection vulnerability, you can test the /modal_add_room1.php endpoint with payloads like ' OR 1=1 -- or using time-based blind techniques such as sleep(5) in the room_name parameter. Monitor for unusual delays or errors in responses.

Impact Analysis

This vulnerability allows remote attackers to gain unauthorized access to the system by manipulating the ID argument. This could lead to data breaches, unauthorized data manipulation, or system control. The public availability of an exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability could lead to unauthorized database access, data manipulation, or deletion, which may violate compliance requirements under GDPR (data protection) and HIPAA (patient data security). Unauthorized access to sensitive data could result in legal penalties, data breaches, and loss of trust.

Mitigation Strategies

Immediately apply input validation to sanitize the room_name parameter. Replace direct SQL queries with prepared statements and parameter binding. Restrict database user permissions to least privilege. Conduct a security audit to identify other potential vulnerabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85512. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart