CVE-2026-2196
📋 TL;DR
This SQL injection vulnerability in code-projects Online Reviewer System 1.0 allows attackers to manipulate database queries through the test_id parameter in exam-update.php. Remote attackers can potentially access, modify, or delete database contents. All deployments of this specific software version are affected.
💻 Affected Systems
- code-projects Online Reviewer System
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized database access allowing extraction of sensitive information like user credentials, assessment data, and system configurations
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data
🎯 Exploit Status
Exploit details are publicly available and SQL injection is a well-understood attack vector with many automated tools available
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates 2. Apply parameterized queries or input validation 3. Sanitize all user inputs before database interaction
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock SQL injection patterns targeting exam-update.php
ModSecurity: SecRule ARGS:test_id "@detectSQLi" "id:1001,phase:2,deny,status:403"
Input Validation Filter
allAdd server-side validation for test_id parameter
PHP: if(!is_numeric($_POST['test_id'])) { die('Invalid input'); }
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system from critical assets
- Deploy database monitoring to detect unusual SQL queries and access patterns
🔍 How to Verify
Check if Vulnerable:
Test the exam-update.php endpoint with SQL injection payloads like test_id=1' OR '1'='1Check Version:
Check system configuration files or admin panel for version informationVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple failed login attempts following SQL injection patterns
- Database queries with unusual syntax from web application
Network Indicators:
- HTTP POST requests to exam-update.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="*exam-update.php*" AND (param="*test_id*" AND value="*' OR *" OR value="*UNION*" OR value="*SELECT*" OR value="*--*" OR value="*;*" OR value="*/*")