CVE-2026-16152 Overview
CVE-2026-16152 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_rooma.php script, where the ID parameter is passed to a database query without proper sanitization. An unauthenticated attacker can manipulate the ID argument to inject arbitrary SQL statements. The attack is executable remotely over the network and requires no user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic scanning and exploitation attempts against exposed installations.
Critical Impact
Remote unauthenticated attackers can inject SQL statements through the ID parameter of /edit_rooma.php, exposing database contents and potentially altering timetabling records.
Affected Products
- SourceCodester Class and Exam Timetabling System 1.0
- Component: /edit_rooma.php
- Vulnerable parameter: ID
Discovery Timeline
- 2026-07-18 - CVE-2026-16152 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-16152
Vulnerability Analysis
The vulnerability is classified under [CWE-74] as improper neutralization of special elements in output used by a downstream component, specifically manifesting as SQL injection. The edit_rooma.php endpoint accepts an ID value from the request and concatenates it into a SQL statement without parameterization or input filtering. An attacker submitting crafted SQL syntax through this parameter can break out of the intended query context.
Successful exploitation can lead to unauthorized reading of database records, modification of timetabling data, or extraction of stored credentials used by the application. Because the endpoint is reachable remotely and requires no authentication, opportunistic attackers can automate discovery and exploitation. The EPSS probability for this CVE is 0.284%, reflecting a moderate but non-trivial likelihood of exploitation attempts given the public disclosure.
Root Cause
The root cause is the direct inclusion of user-supplied input in a SQL query. The application does not validate the ID parameter as a numeric identifier, nor does it use prepared statements or bound parameters. This lack of separation between code and data allows arbitrary SQL syntax to alter query behavior.
Attack Vector
An attacker sends an HTTP request to /edit_rooma.php with a malicious payload appended to the ID parameter. Common exploitation techniques include boolean-based blind injection, union-based extraction, and time-based blind injection. No authentication or user interaction is required, and the exploit has been published through the referenced VulDB and GitHub issue tracker.
The vulnerability manifests through unsanitized concatenation of the ID GET parameter into a SQL query. See the GitHub Issue Discussion and VulDB CVE-2026-16152 advisory for technical details of the disclosed exploit.
Detection Methods for CVE-2026-16152
Indicators of Compromise
- HTTP requests to /edit_rooma.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, --, or /* in the ID parameter.
- Web server logs showing unusually long ID values or encoded SQL keywords targeting the timetabling endpoint.
- Database error messages returned in HTTP responses, indicating query manipulation attempts.
- Anomalous outbound database queries from the application host, particularly against information_schema or user tables.
Detection Strategies
- Deploy web application firewall (WAF) signatures that flag SQL injection patterns in query and body parameters targeting edit_rooma.php.
- Enable database query logging and alert on queries containing UNION, SELECT chained with metadata tables, or benchmarking functions from the application user.
- Correlate web access logs with database audit logs to identify request-to-query patterns indicative of injection.
Monitoring Recommendations
- Monitor the timetabling application host for unexpected file writes, credential access, or lateral movement following suspicious edit_rooma.php traffic.
- Track authentication anomalies on database accounts used by the web application, including failed logins and privilege enumeration.
- Alert on repeated 500-series HTTP responses from /edit_rooma.php, which often indicate injection probing.
How to Mitigate CVE-2026-16152
Immediate Actions Required
- Restrict network access to the Class and Exam Timetabling System, placing it behind authenticated VPN or IP allowlisting until a fix is available.
- Deploy WAF rules to block SQL metacharacters and known injection payloads on the ID parameter of /edit_rooma.php.
- Rotate database credentials used by the application if exploitation is suspected, and review database contents for tampering.
- Audit web server and database logs for prior exploitation attempts referencing /edit_rooma.php.
Patch Information
No official vendor patch has been published at the time of NVD publication on 2026-07-18. Administrators should monitor the SourceCodester Resource Listing and the VulDB Vulnerability #379918 entry for updates. If no patch is released, consider replacing the vulnerable endpoint with a rewritten version that uses prepared statements.
Workarounds
- Modify edit_rooma.php to cast the ID parameter to an integer before use, for example using intval() in PHP.
- Replace direct query concatenation with parameterized queries via PDO or mysqli prepared statements.
- Apply least-privilege permissions to the database account used by the application, removing rights to information_schema or write access where not required.
- Disable public exposure of the application if it is not required for operational use.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
