Class and Exam Timetabling System CVE-2026-16228

No authentication is required - the CVSS 4.0 vector specifies PR:N and UI:N, confirming unauthenticated remote exploitation with no user interaction needed. The sole prerequisite is that the /edit_schoolyr.php file be reachable over a network and that the application be running SourceCodester Class and Exam Timetabling System 1.0 with a PHP/MySQL backend. No non-default configuration or special feature flag is required. Exploitation is limited by deployment context: the software is a niche PHP demo application not typically deployed in enterprise or regulated environments, and instances with no internet exposure are not reachable remotely. No platform-specific OS requirement is identified beyond a standard PHP web hosting stack.

The CVSS 4.0 score of 6.9 (Medium) reflects network accessibility with no authentication or complexity requirements, offset by low-magnitude impact across confidentiality, integrity, and availability. No EPSS data was provided in the intelligence feed, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis. However, a public POC exists on GitHub, significantly lowering the skill threshold for exploitation. The principal risk limiter is prevalence: SourceCodester distributes free demo-quality PHP scripts primarily for student and hobbyist use, and production deployment at scale is unlikely. Organizations running this application in an internet-accessible environment should treat this as a higher practical priority than the CVSS score alone suggests, given the zero-barrier exploit path and public POC. No conflicting signals were detected between the CVSS vector and the description - both consistently indicate unauthenticated remote network access.

An unauthenticated remote attacker sends a crafted HTTP GET or POST request to /edit_schoolyr.php with a SQL injection payload embedded in the ID parameter (e.g., ID=1' UNION SELECT username,password,3 FROM users--). The application passes the unsanitized value directly into a SQL query, allowing the attacker to enumerate database tables, extract credentials or student records, or insert/modify data. A public POC on GitHub (https://github.com/fichterclapsaddle879-rgb/MyCve/issues/1) confirms this technique is documented and reproducible with minimal attacker skill.