CVE-2026-16227: SQL Injection in SourceCodester Class and Exam Timetabling System

Overview

CVE-2026-16227 is a SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System 1.0. The flaw exists in the /edit_subject.php endpoint, where user-supplied input via the ID parameter is passed directly to a database query without proper sanitization or parameterization.

The vulnerability is exploitable remotely without authentication and has been publicly disclosed with a working proof-of-concept exploit.

Technical Details

The vulnerability stems from unsanitized handling of the ID GET/POST parameter in /edit_subject.php. An attacker can craft a malicious request that injects arbitrary SQL commands into the backend query, enabling:

• Data extraction: Dumping database tables including user credentials, subject records, and schedule data
• Authentication bypass: Manipulating login logic if the parameter feeds auth-related queries
• Data manipulation: Inserting, modifying, or deleting records in the application database
• Information disclosure: Enumerating database schema, version, and potentially server-side configuration

A typical attack payload would append SQL meta-characters or UNION SELECT statements to the ID parameter value, exploiting the absence of prepared statements.

Impact

While SourceCodester applications are typically used in academic and small-institution environments, exploitation of this vulnerability could result in:

• Unauthorized access to student, faculty, and scheduling data
• Modification of exam timetables or subject records
• Full compromise of the backend database if the database user has elevated privileges
• Potential lateral movement if database credentials are reused elsewhere in the environment

Affected Versions

Remediation

SourceCodester has not released an official patch at time of publication. Organizations running this software should apply the following mitigations:

1. Parameterized queries: Replace all dynamic SQL construction with prepared statements or parameterized queries. This is the definitive fix for SQL injection.
2. Input validation: Enforce strict integer validation on the ID parameter — reject any non-numeric input at the application layer.
3. Web Application Firewall (WAF): Deploy a WAF with SQL injection rules enabled to detect and block malicious payloads at the network edge.
4. Restrict access: If the timetabling system is only needed internally, place it behind a VPN or network access control to remove it from public internet exposure.
5. Principle of least privilege: Ensure the database user account used by the application has the minimum permissions necessary (SELECT/INSERT/UPDATE only on required tables — no DROP, no admin rights).
6. Monitor database logs: Enable query logging and alert on anomalous patterns such as UNION, SLEEP(), or multi-statement queries.

References

• NVD Entry — CVE-2026-16227
• OWASP SQL Injection Prevention Cheat Sheet
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command