Overview
CVE-2026-16228 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0, closely related to CVE-2026-16227 disclosed on the same day. This flaw exists in /edit_schoolyr.php, a separate endpoint for editing school year records, where the ID parameter is not properly sanitized before being used in database queries.
Like its companion CVE, this vulnerability is remotely exploitable without authentication, and a public proof-of-concept exploit has been made available.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-16228 |
| CVSS Score | 7.3 (High) |
| Affected Software | SourceCodester Class and Exam Timetabling System 1.0 |
| Affected File | /edit_schoolyr.php |
| Vulnerable Parameter | ID |
| Attack Vector | Network (Remote) |
| Authentication Required | None |
| Exploit Available | Yes (publicly disclosed) |
Technical Details
The /edit_schoolyr.php endpoint accepts an ID parameter used to retrieve and pre-populate a school year record for editing. This value is concatenated directly into a SQL query without parameterization, allowing an attacker to inject arbitrary SQL.
Exploitation scenarios include:
- UNION-based data extraction: Enumerating all database tables and extracting records across the application
- Boolean-blind injection: Inferring data character-by-character through true/false application responses
- Time-based blind injection: Using
SLEEP()or similar functions to infer data when no output is reflected - Stacked queries (if the database driver supports it): Executing multiple statements to perform INSERT, UPDATE, or DROP operations
The simultaneous disclosure of CVE-2026-16227 (/edit_subject.php) and CVE-2026-16228 (/edit_schoolyr.php) suggests a systemic lack of input sanitization across the application's edit endpoints.
Impact
Both CVEs share the same root cause: raw concatenation of user input into SQL queries. Organizations running this application face:
- Data exposure: Academic records, scheduling data, user credentials accessible to any remote attacker
- Data integrity loss: School year records can be altered or deleted, disrupting scheduling operations
- Compounded risk: With two known SQLi endpoints, the application's entire data layer must be considered compromised until patched
Affected Versions
| Product | Version | Status |
|---|---|---|
| SourceCodester Class and Exam Timetabling System | 1.0 | Vulnerable |
Remediation
No vendor patch is available. Apply the same mitigations as CVE-2026-16227:
- Parameterized queries / prepared statements: The only reliable fix — never concatenate user input into SQL strings.
- Strict type validation: Enforce integer-only input for ID parameters at the controller/handler level.
- WAF deployment: Use a web application firewall to filter SQL injection patterns in transit.
- Network isolation: Remove public internet access to the application if it is used only within an institution's internal network.
- Database least privilege: Restrict the application's database account permissions to what is strictly necessary for normal operation.
- Security audit: Given that two SQLi endpoints were found, conduct a full code audit of all other form-handling endpoints in the application.
Related Advisories
- CVE-2026-16227 — SQL Injection in
/edit_subject.php(same application, same day)