Hackone

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** Remote SQL injection is possible via the manipulation of the `ID` argument in the '/edit subject.php' endpoint. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to interfere with the database. **Recommendations** Update SourceCodester Class and Exam Timetabling System version 1.0 to a version that contains a fix for this issue. As a temporary workaround, restrict access to the '/edit subject.php' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** An issue exists in the `/edit schoolyr.php` endpoint where manipulating the `ID` argument allows for remote SQL injection. SQL injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing them to read, modify, or delete data from the database. **Recommendations** Update SourceCodester Class and Exam Timetabling System version 1.0 to a patched version. As a temporary workaround, restrict access to the `/edit schoolyr.php` file to minimize the risk of exploitation.