SQL Injection in Class and Exam Timetabling System

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive2.php. Such manipulation of the argument sy leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-11485 is a remote SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System version 1.0. The flaw exists in the /archive2.php file where unsanitized user input in the 'sy' parameter is directly concatenated into SQL queries, allowing attackers to manipulate database operations without authentication. This vulnerability matters because timetabling systems often manage sensitive institutional data including student records, schedules, and personnel information. Educational institutions, training centers, and any organization using this system are at immediate risk, especially given the CVSS score of 7.3 (high) and public disclosure of exploit code.

Casky.ai's 301 matching skills leverage Claude's extended reasoning to correlate this vulnerability with MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify detection patterns spanning multiple attack phases: reconnaissance activities probing the /archive2.php endpoint for SQL syntax acceptance, followed by exploitation attempts injecting paylomatic payloads through the 'sy' parameter. The platform's skills map CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection) to specific behavioral indicators—such as unusual query structures in application logs, unexpected database connection patterns, and data exfiltration queries—enabling security teams to distinguish legitimate timetable queries from malicious SQL injection attempts in real-time monitoring dashboards.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11485.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-11485

Casky has 301 skills that investigate the attack patterns behind CVE-2026-11485. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn