Timetabling System CVE-2026-16154

No special conditions - remote unauthenticated exploitation against default configurations of the Class and Exam Timetabling System 1.0. The CVSS 4.0 vector confirms PR:N (no privileges required), UI:N (no user interaction), and AC:L/AT:N (no complexity or attack prerequisites). The sole structural requirement is that /edit_room1.php is network-reachable, which is the default deployment posture for a web application. Exploitation is limited in scope to the application's database (SC:N/SI:N/SA:N in CVSS 4.0), meaning lateral movement beyond the database is not directly enabled by this vulnerability alone. There is no indication of platform, operating system, or configuration prerequisite beyond the application being installed and accessible.

The CVSS 4.0 score of 6.9 reflects moderate severity: AV:N/AC:L/AT:N/PR:N/UI:N indicates trivially exploitable over the network with no prerequisites, but the impact triad VC:L/VI:L/VA:L limits the ceiling - this is a partial read/write/disruption scenario, not full compromise. No EPSS data was provided in the input, so exploitation probability cannot be quantitatively assessed. The public POC on GitHub (E:P in the CVSS 4.0 vector) confirms working exploit code exists, which elevates operational urgency beyond what the base score alone suggests. The absence of a CISA KEV listing means active widespread exploitation is not confirmed, but with a no-auth network vector and working POC, opportunistic scanning is a credible near-term risk. The primary mitigating factor is prevalence: this is a niche academic tool with a small deployment footprint, which substantially bounds aggregate real-world impact.

An unauthenticated attacker sends a crafted HTTP request to the publicly accessible /edit_room1.php endpoint, injecting SQL syntax into the ID parameter (e.g., 1 UNION SELECT user,password FROM users--). Because the application passes the parameter directly to a SQL query without sanitization, the injected clause executes against the underlying database, returning credential or timetable data in the HTTP response. A working proof-of-concept demonstrating this technique is publicly available on GitHub, meaning no custom exploit development is required.