SQL Injection in Class and Exam Timetabling System

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /index2.php. The manipulation of the argument Password results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-11471 is a critical SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System version 1.0, specifically in the password parameter of /index2.php. This vulnerability allows unauthenticated attackers to manipulate SQL queries remotely, potentially leading to unauthorized data access, modification, or deletion of sensitive academic records. Educational institutions using this timetabling system face direct risk of compromise, as the exploit has already been made public and weaponized in the wild. The vulnerability is particularly dangerous because it targets authentication mechanisms—the password field—making it a direct gateway to system compromise before traditional access controls can be enforced.

Casky's 301 mapped skills detect this attack pattern by correlating indicators across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Resource Development). Practitioners using Casky would observe detection findings highlighting CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection) signatures, with Claude's extended reasoning identifying malicious SQL syntax patterns in password field submissions—such as UNION-based queries, time-based blind injection payloads, or boolean-based logic manipulation. The platform would flag anomalous authentication attempts with SQL metacharacters, unusual database query timing patterns, and privilege escalation sequences, enabling security teams to distinguish genuine exploitation attempts from benign traffic before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11471.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-11471

Casky has 301 skills that investigate the attack patterns behind CVE-2026-11471. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn