CVE-2026-75080

CVE-2026-75080 is a SQL injection vulnerability in `/edit_subject1.php` of SourceCodester's Timetabling System 1.0. The affected parameter is `id`, passed directly into a mysqli_query() call without parameterization. A GET or POST request to this endpoint with a crafted `id` value allows arbitrary SQL execution against the backend database. The root cause is not developer negligence — it's the PHP ecosystem's persistence of insecure defaults. The mysqli_* extension retained the same raw-string API that its deprecated mysql_* predecessor used, meaning developers upgrading from older PHP versions could copy their existing patterns verbatim and have them continue working. PDO introduced prepared statements in PHP 5.1, but they require explicit opt-in; the intuitive path remains string concatenation. This is the structural reality: the vulnerability isn't a deviation from best practice, it's the path of least resistance codified into the language's most commonly used database API. What makes this CVE particularly concerning is the blast radius. SourceCodester functions as a distribution mechanism for community-contributed PHP projects, serving developers under real resource constraints — hobbyists, students, small-organizational deployments. The same accessibility that makes the platform useful (copy-pasteable code templates) makes it a vulnerability amplifier. Every fork and deployment of this codebase inherits the same injection point. The exposure isn't one application; it's hundreds of instances carrying identical genetic flaws. The remediation gap compounds this problem. SourceCodester has no SLA for patch publication, and the same economic pressure that drives developers to use free community code prevents them from auditing what they deploy. Post-disclosure, there's a dangerous window where developers Googling solutions may land on the vulnerable patterns (still indexed in Stack Overflow answers from 2013-2018) before the actual patch is available, potentially implementing flawed remediations. Defenders should: first, identify all instances of this Timetabling System version in your environment and treat them as compromised until patched; second, audit any forks or derivatives for the same injection pattern in other PHP files — if `edit_subject1.php` uses direct string concatenation, similar files likely do too; third, if you must deploy PHP applications from community platforms, implement parameterized queries at the application boundary before deployment, accepting that the upstream code likely won't provide secure defaults. The platform will continue publishing vulnerable code. The question is whether your deployment pipeline accounts for that.

Reviewed through automated stages and approved by a human before publication.