CVE-2026-2197
📋 TL;DR
This SQL injection vulnerability in code-projects Online Reviewer System 1.0 allows remote attackers to execute arbitrary SQL commands via the test_id parameter in the exam-delete.php file. This can lead to unauthorized data access, modification, or deletion. All systems running the vulnerable version are affected.
💻 Affected Systems
- code-projects Online Reviewer System
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized access to sensitive assessment data, user information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub and vuldb.com, making this easily exploitable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Implement workarounds or consider migrating to a different system.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd proper input validation and parameterized queries to the exam-delete.php file
Modify /system/system/admins/assessments/pretest/exam-delete.php to use prepared statements
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules
🧯 If You Can't Patch
- Restrict access to the vulnerable endpoint using network ACLs or authentication
- Implement database-level controls with minimal necessary permissions
🔍 How to Verify
Check if Vulnerable:
Check if /system/system/admins/assessments/pretest/exam-delete.php exists and accepts test_id parameter without proper validationCheck Version:
Check application version in configuration files or admin panelVerify Fix Applied:
Test SQL injection attempts against the endpoint to confirm they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed delete attempts with malformed test_id parameters
Network Indicators:
- HTTP requests to exam-delete.php with SQL injection payloads in test_id parameter
SIEM Query:
source="web_logs" AND uri="/system/system/admins/assessments/pretest/exam-delete.php" AND (test_id CONTAINS "'" OR test_id CONTAINS "--" OR test_id CONTAINS "UNION")