Executive Summary
CVE-2026-16154 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0, affecting the /edit_room1.php endpoint. This is a companion to CVE-2026-16152, which targets a related endpoint (/edit_rooma.php). Both vulnerabilities share the same root cause — unsanitized use of the ID GET/POST parameter in SQL queries — and both carry a CVSS score of 7.3 (High) with a public exploit already released.
CVSS Score: 7.3 (High)
Vulnerability Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-16154 |
| CVSS Score | 7.3 (High) |
| CWE | CWE-89: SQL Injection |
| Attack Vector | Network (Remote) |
| Privileges Required | Low |
| User Interaction | None |
| Exploit Available | Yes (public) |
Affected Component
The vulnerability is present in the /edit_room1.php file within SourceCodester Class and Exam Timetabling System version 1.0. The ID parameter is not properly sanitized before being included in database queries, allowing attackers to append arbitrary SQL directives.
Relationship to CVE-2026-16152
These two CVEs represent a pattern of insecure coding across the same application. When one endpoint in an application is found vulnerable to SQL injection, similar endpoints built with the same code patterns are often equally susceptible. Organizations using this software should treat both vulnerabilities as part of a broader systemic issue rather than isolated bugs.
Impact
A remote attacker exploiting this vulnerability could:
- Extract database contents including room records, user credentials, and scheduling data
- Manipulate scheduling data to disrupt exam and class timetables
- Escalate privileges if the database account has elevated permissions
- Chain with other vulnerabilities in the same application for deeper access
Remediation
- Restrict access to
/edit_room1.phpat the network perimeter or web server level - Implement parameterized queries or prepared statements throughout the application
- Audit all similar endpoints in the codebase — the pattern likely repeats across other
edit_*.phppages - Apply the principle of least privilege to the database account used by this application
- Monitor for active exploitation using WAF rules targeting SQL injection patterns on this application