CVE-2026-16152: SQL Injection in SourceCodester Class and Exam Timetabling System

Executive Summary

CVE-2026-16152 is a SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_rooma.php endpoint, where manipulation of the ID argument leads to unsanitized SQL query execution. The vulnerability is remotely exploitable and a public exploit has been made available.

CVSS Score: 7.3 (High)

Vulnerability Details

Affected Component

The vulnerability exists in the /edit_rooma.php script of the SourceCodester Class and Exam Timetabling System version 1.0. The ID parameter is passed directly into a SQL query without proper sanitization or parameterized queries, enabling an attacker to inject arbitrary SQL commands.

Impact

Successful exploitation of this vulnerability could allow a remote attacker to:

• Read sensitive data from the application's database, including user credentials, room assignments, and schedule data
• Modify or delete records within the timetabling system
• Bypass authentication if credential tables are accessible via the injection point
• Execute database commands depending on the database user's privileges

Remediation

Since this vulnerability is in SourceCodester open-source software, users running this application should:

1. Immediately restrict access to the /edit_rooma.php endpoint at the web server or firewall level
2. Apply input validation and use prepared statements / parameterized queries for all database interactions
3. Review the full codebase for similar patterns — SourceCodester applications commonly reuse vulnerable patterns across multiple endpoints (see also CVE-2026-16154)
4. Monitor database logs for unusual query patterns that may indicate active exploitation
5. Consider replacing the application with a supported, maintained alternative if no official patch is released

References

• NVD Entry — CVE-2026-16152
• CWE-89: Improper Neutralization of Special Elements in SQL Commands