CVE-2026-2173
📋 TL;DR
CVE-2026-2173 is an SQL injection vulnerability in code-projects Online Examination System 1.0 that allows attackers to manipulate database queries through the login.php username/password parameters. This enables unauthorized database access, data theft, or system compromise. Organizations using this specific software version are affected.
💻 Affected Systems
- code-projects Online Examination System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, authentication bypass, privilege escalation, or remote code execution on the underlying server.
Likely Case
Unauthorized access to sensitive examination data, student records, or administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting unauthorized actions.
🎯 Exploit Status
SQL injection via login parameters typically requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If patch available, download and apply. 3. Replace vulnerable login.php with patched version. 4. Test authentication functionality.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to reject malicious SQL characters in username/password fields
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting login.php
🧯 If You Can't Patch
- Implement parameterized queries/prepared statements in login.php
- Restrict database user permissions to minimum required functionality
🔍 How to Verify
Check if Vulnerable:
Test login.php with SQL injection payloads like ' OR '1'='1 in username/password fields and observe database errors or unexpected behavior.Check Version:
Check software documentation or admin panel for version information; typically displayed in footer or about page.Verify Fix Applied:
Retest with same SQL injection payloads; should receive proper error messages or failed authentication without database errors.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in login attempts
- Database error messages in application logs
- Multiple failed logins with SQL characters
Network Indicators:
- HTTP POST requests to login.php containing SQL keywords like UNION, SELECT, OR
SIEM Query:
source="web_logs" AND uri="/login.php" AND (request_body CONTAINS "' OR" OR request_body CONTAINS "UNION SELECT" OR request_body CONTAINS "--")