Executive Summary
CVE-2026-16152 is a SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_rooma.php endpoint, where manipulation of the ID argument leads to unsanitized SQL query execution. The vulnerability is remotely exploitable and a public exploit has been made available.
CVSS Score: 7.3 (High)
Vulnerability Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-16152 |
| CVSS Score | 7.3 (High) |
| CWE | CWE-89: SQL Injection |
| Attack Vector | Network (Remote) |
| Privileges Required | Low |
| User Interaction | None |
| Exploit Available | Yes (public) |
Affected Component
The vulnerability exists in the /edit_rooma.php script of the SourceCodester Class and Exam Timetabling System version 1.0. The ID parameter is passed directly into a SQL query without proper sanitization or parameterized queries, enabling an attacker to inject arbitrary SQL commands.
Impact
Successful exploitation of this vulnerability could allow a remote attacker to:
- Read sensitive data from the application's database, including user credentials, room assignments, and schedule data
- Modify or delete records within the timetabling system
- Bypass authentication if credential tables are accessible via the injection point
- Execute database commands depending on the database user's privileges
Remediation
Since this vulnerability is in SourceCodester open-source software, users running this application should:
- Immediately restrict access to the
/edit_rooma.phpendpoint at the web server or firewall level - Apply input validation and use prepared statements / parameterized queries for all database interactions
- Review the full codebase for similar patterns — SourceCodester applications commonly reuse vulnerable patterns across multiple endpoints (see also CVE-2026-16154)
- Monitor database logs for unusual query patterns that may indicate active exploitation
- Consider replacing the application with a supported, maintained alternative if no official patch is released