CVE-2026-16228: Class and Exam Timetabling System SQLi

CVE-2026-16228 Overview

CVE-2026-16228 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_schoolyr.php script, where the ID parameter is passed to a database query without proper sanitization. Attackers can manipulate the ID argument to inject arbitrary SQL statements. Exploitation requires no authentication and can be performed remotely over the network. Public exploit details are already available, increasing the likelihood of opportunistic attacks against exposed installations. The issue is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL through the ID parameter of /edit_schoolyr.php, exposing backend database contents to read, modification, or deletion.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Component: /edit_schoolyr.php
Vulnerable parameter: ID

Discovery Timeline

2026-07-19 - CVE-2026-16228 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-16228

Vulnerability Analysis

The vulnerability is a classic SQL injection issue in the school year editing workflow of the Class and Exam Timetabling System. When a user requests /edit_schoolyr.php, the application accepts an ID parameter that identifies the school year record to edit. The value is concatenated directly into a SQL query without parameterization or input validation. Attackers can supply crafted values containing SQL operators, boolean payloads, UNION SELECT statements, or time-based blind payloads. The attack requires no privileges and no user interaction. The EPSS score of 0.263% reflects moderate near-term exploitation probability, though public exploit availability materially raises real-world risk.

Root Cause

The root cause is unsafe SQL query construction in /edit_schoolyr.php. The ID argument reaches the database layer without prepared statements, parameter binding, or type casting. This maps to [CWE-74] and specifically to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Attack Vector

Exploitation is network-based via HTTP requests to the vulnerable endpoint. An attacker sends a request such as GET /edit_schoolyr.php?ID=<payload> with SQL metacharacters appended to the ID value. Because the application returns query results or error output, both in-band (error-based, UNION-based) and blind (boolean, time-based) techniques are viable. Successful exploitation permits arbitrary read and write access to the underlying database, including credential tables and scheduling data. See the VulDB Vulnerability Details and GitHub Issue Discussion for technical references.

Detection Methods for CVE-2026-16228

Indicators of Compromise

HTTP requests to /edit_schoolyr.php containing SQL metacharacters in the ID parameter, such as single quotes, UNION, SELECT, SLEEP(, or -- comment markers.
Web server or PHP error logs referencing SQL syntax errors originating from edit_schoolyr.php.
Unexpected outbound queries or extended query execution times against the timetabling database.
New or modified rows in administrative tables without corresponding legitimate application activity.

Detection Strategies

Deploy web application firewall (WAF) signatures targeting SQL injection patterns on the ID parameter of /edit_schoolyr.php.
Enable database query logging and alert on queries containing tautologies (OR 1=1), stacked queries, or INFORMATION_SCHEMA references from the application account.
Correlate web access logs with database audit logs to identify suspicious ID values driving anomalous SQL activity.

Monitoring Recommendations

Alert on repeated 500-series HTTP responses from /edit_schoolyr.php, which often accompany injection probing.
Monitor for authentication bypass indicators such as sudden admin session creation following requests to the vulnerable endpoint.
Track outbound data volumes from the database host to detect bulk exfiltration through UNION-based extraction.

How to Mitigate CVE-2026-16228

Immediate Actions Required

Restrict network access to the Class and Exam Timetabling System until a patched version is available, allowing only trusted administrative IP ranges.
Place the application behind a WAF with SQL injection rulesets tuned for the ID parameter on /edit_schoolyr.php.
Rotate database credentials and audit database accounts for unauthorized changes.
Review web and database logs for prior exploitation attempts against the endpoint.

Patch Information

No official vendor patch has been published at the time of writing. SourceCodester distributes the Class and Exam Timetabling System 1.0 as source code, so operators must remediate the code directly. Refactor /edit_schoolyr.php to use PDO or MySQLi prepared statements with bound parameters, and cast the ID value to an integer before use. Monitor the SourceCodester Blog and the VulDB CVE Report for updates.

Workarounds

Enforce strict server-side type validation so ID accepts only integer values, rejecting any request containing non-numeric characters.
Apply least-privilege permissions to the database user backing the application, revoking DROP, ALTER, and cross-database SELECT rights.
Disable verbose PHP and SQL error output in production to reduce information available to attackers performing error-based injection.
Consider taking the affected module offline until custom code changes are validated in a test environment.

bash

# Configuration example: nginx location block enforcing numeric ID and blocking common SQLi tokens
location = /edit_schoolyr.php {
    if ($arg_ID !~ '^[0-9]+$') { return 400; }
    if ($args ~* '(union|select|sleep\(|information_schema|--)') { return 403; }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}