CVE-2026-16484: Class Timetabling System SQLi Flaw

CVE-2026-16484 Overview

CVE-2026-16484 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /edit_subjecta.php script, where the ID parameter is passed to a database query without proper sanitization. Remote attackers can manipulate the ID argument to inject arbitrary SQL statements. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Public disclosure indicates the exploit has been published and may be used against unpatched deployments.

Critical Impact
Unauthenticated remote attackers can inject SQL through the ID parameter of /edit_subjecta.php, exposing database contents and enabling data manipulation.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Vulnerable script: /edit_subjecta.php
Vulnerable parameter: ID

Discovery Timeline

2026-07-21 - CVE-2026-16484 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16484

Vulnerability Analysis

The vulnerability exists in the edit_subjecta.php endpoint of SourceCodester Class and Exam Timetabling System 1.0. The application accepts an ID value from the HTTP request and concatenates it directly into a SQL query executed against the backend database. Because the parameter is neither validated nor parameterized, attackers can inject SQL syntax that alters the query's logic.

Exploitation requires no authentication and no user interaction. An attacker sends a crafted HTTP request over the network to the affected script. Successful injection can disclose stored records, modify entries, or bypass application logic tied to subject records. The published EPSS probability is 0.412%, placing the CVE in the 33.7 percentile for near-term exploitation likelihood.

Root Cause

The root cause is improper neutralization of user-supplied input before it is included in an SQL statement. The ID parameter is trusted as-is, without prepared statements, parameter binding, or input filtering. This maps directly to [CWE-74], the general injection weakness class covering SQL injection.

Attack Vector

The attack vector is network-based. An attacker issues an HTTP GET or POST request to /edit_subjecta.php with a manipulated ID value containing SQL metacharacters or tautologies. Typical payloads append UNION SELECT clauses, boolean conditions, or time-based delays to extract data or infer database structure. Because the endpoint does not enforce authentication in the reported configuration, exploitation can be automated against exposed instances.

A public proof-of-concept is referenced in the GitHub Issue Report and VulDB Vulnerability Details.

Detection Methods for CVE-2026-16484

Indicators of Compromise

HTTP requests to /edit_subjecta.php containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP( in the ID parameter
Web server access logs showing unusually long or URL-encoded ID values
Database error messages returned in HTTP responses referencing MySQL or SQL syntax
Repeated requests to edit_subjecta.php from a single source with incrementing or fuzzed ID values

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the ID query parameter for SQL injection patterns
Enable database query logging and alert on queries containing untypical operators against the subjects table
Correlate web access logs with database error logs to identify injection probes
Review application logs for requests to edit_subjecta.php from unauthenticated sessions

Monitoring Recommendations

Monitor outbound data volumes from the database server for signs of bulk extraction
Track HTTP 500 responses originating from edit_subjecta.php as an indicator of failed injection attempts
Alert on any modification to the subjecta table performed outside of normal administrative sessions

How to Mitigate CVE-2026-16484

Immediate Actions Required

Restrict network access to the Class and Exam Timetabling System until a vendor patch is available
Place the application behind a WAF with SQL injection signatures enabled
Audit database accounts used by the application and enforce least-privilege permissions
Review web and database logs for prior exploitation attempts against /edit_subjecta.php

Patch Information

No official vendor patch is referenced in the CVE record at the time of publication. Administrators should monitor SourceCodester Security Resources and the VulDB CVE-2026-16484 entry for future updates. Until a fix is provided, apply source-level remediation by replacing string concatenation with parameterized queries or prepared statements in edit_subjecta.php.

Workarounds

Modify edit_subjecta.php to cast the ID parameter to an integer before use in SQL statements
Implement server-side allowlist validation to reject non-numeric ID values
Disable or remove the edit_subjecta.php endpoint if it is not required in production
Isolate the application database account so it cannot read or modify unrelated tables

bash

# Example Apache configuration to block non-numeric ID values
<Location "/edit_subjecta.php">
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (^|&)ID=([^0-9&]|%) [NC]
    RewriteRule .* - [F,L]
</Location>