Timetabling System CVE-2026-16227

The /edit_subject.php endpoint must be network-reachable - no authentication is required per PR:N in the CVSS 4.0 vector, and no special application configuration or non-default feature flag is needed beyond a standard installation of SourceCodester Class and Exam Timetabling System 1.0. The application must be running on a PHP stack with a SQL database backend. Exploitation is limited by network exposure: instances restricted to localhost or isolated internal networks without external routing are not reachable remotely. The partial impact ceiling (VC:L/VI:L/VA:L rather than H) suggests the database service account may have restricted privileges, which would limit the depth of data accessible or modifiable - however, this is inferred from CVSS metrics, not confirmed by vendor documentation.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) reflects a network-reachable, zero-authentication flaw with partial impact across confidentiality, integrity, and availability - consistent with typical SQL injection that enables data enumeration and manipulation but not direct OS-level compromise without further chaining. The E:P modifier confirming public exploit availability meaningfully elevates practical near-term risk beyond the base score alone. The absence of a CISA KEV listing means confirmed widespread active exploitation has not been observed, but the combination of unauthenticated network access, a publicly available POC, and no patch creates a credible opportunistic exploitation window. EPSS data was not provided in the intelligence set; this is a gap in the risk picture. The limited impact metrics (all L, no H) suggest the database user may operate with restricted privileges, but this cannot be confirmed without vendor disclosure. Overall this is a genuine priority for any internet-exposed deployment, not a theoretical risk.

An unauthenticated attacker identifies an internet-exposed instance of the application via search engine dorking or automated scanning and sends a crafted HTTP request to /edit_subject.php?id=1%27%20OR%20%271%27%3D%271 (or an equivalent payload). Using the publicly available POC on GitHub as a template, the attacker enumerates database tables and extracts user credentials, student records, or administrative data without any prior authentication. The low attack complexity means this is within reach of automated exploitation tooling with no manual skill required.