Description
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Published: 2026-07-18
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Affected by a SQL injection flaw in the edit_rooma.php script, where a manipulated ID argument allows attackers to execute arbitrary SQL statements. This vulnerability can lead to unauthorized data disclosure, modification, or deletion, and potentially full compromise of the application’s database. The issue is classified as CWE-74 and CWE-89, reflecting malformed input handling and SQL injection weaknesses.

Affected Systems

Affected systems are users of SourceCodester Class and Exam Timetabling System version 1.0. No other versions are listed as impacted, so only installations of the 1.0 release are considered at risk.

Risk and Exploitability

Risk assessment shows a CVSS score of 6.9, indicating moderate severity. The EPSS score is below 1%, meaning public exploitation is currently uncommon, and it is not in the CISA KEV catalog. However, the vulnerability remains exploitable remotely, and publicly disclosed exploits exist, so the risk to organizations hosting the application is real for exposed servers.

Generated by OpenCVE AI on July 30, 2026 at 22:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of SourceCodester Class and Exam Timetabling System that includes the SQL injection fix.
  • If upgrade is not possible, limit exposure by restricting the edit_rooma.php endpoint to authorized users only through application‑level authentication or firewall rules, effectively blocking unauthenticated access.
  • Implement input validation on the ID parameter so that only integer values are accepted, and refactor the database queries to use prepared statements with bound parameters.

Generated by OpenCVE AI on July 30, 2026 at 22:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 18 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Title SourceCodester Class and Exam Timetabling System edit_rooma.php sql injection
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Class And Exam Timetabling System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-22T14:56:48.533Z

Reserved: 2026-07-17T19:34:00.954Z

Link: CVE-2026-16152

cve-icon Vulnrichment

Updated: 2026-07-22T14:56:45.350Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T23:00:22Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')