CVE-2026-16152 in Class and Exam Timetabling System
Summary
by MITRE • 07/19/2026
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides within the SourceCodester Class and Exam Timetabling System version 1.0, specifically targeting an unknown function within the /edit_rooma.php file. The issue represents a classic sql injection flaw that occurs when the application fails to properly sanitize user input passed through the ID argument parameter. This type of vulnerability falls under the common weakness enumeration CWE-89 which categorizes improper neutralization of special elements used in an sql command. The attack vector is particularly concerning as it enables remote exploitation without requiring any local system access or authentication credentials, making it accessible to threat actors worldwide.
The technical implementation of this vulnerability stems from the application's failure to implement proper input validation and parameterized queries when processing the ID argument within the edit_rooma.php script. When an attacker manipulates the ID parameter through malicious input, the application directly incorporates this unvalidated data into sql query construction without appropriate sanitization or escaping mechanisms. This allows an attacker to inject arbitrary sql commands that execute within the database context, potentially enabling full database compromise including data exfiltration, modification, or even complete system takeover.
The operational impact of this vulnerability extends beyond simple data theft as it provides attackers with significant control over the application's underlying database infrastructure. Remote exploitation capabilities mean that threat actors can target systems from anywhere on the internet without requiring physical access to network resources. The public availability of exploit code further amplifies the risk, as it eliminates the need for advanced technical skills to carry out attacks against vulnerable installations. This vulnerability could result in unauthorized access to exam timetabling data, student information, instructor details, and potentially sensitive institutional data that should remain protected.
Mitigation strategies must address both immediate remediation and long-term architectural improvements to prevent similar vulnerabilities from occurring. The most critical immediate action involves implementing proper input validation and parameterized queries throughout the application, specifically within the edit_rooma.php file and related database interaction points. Organizations should also deploy web application firewalls to detect and block sql injection attempts, implement least privilege database access controls, and conduct comprehensive code reviews focusing on all database interaction points. Additionally, regular security assessments including automated scanning and manual penetration testing should be performed to identify and remediate similar vulnerabilities across the entire application stack, aligning with industry best practices for secure coding as outlined in the OWASP Top Ten and NIST cybersecurity frameworks.
The presence of public exploit code transforms this vulnerability from a theoretical risk into an active threat that requires immediate attention. This situation exemplifies how the disclosure of exploitation techniques can rapidly escalate the severity of security issues, particularly in open source applications with limited security maintenance. Organizations running this specific version of the timetabling system should prioritize patching or implementing compensating controls as the vulnerability has already been weaponized by malicious actors seeking to exploit it for unauthorized database access and potential data compromise operations.