CVE-2026-2198
📋 TL;DR
This SQL injection vulnerability in code-projects Online Reviewer System 1.0 allows attackers to manipulate database queries through the difficulty_id parameter. Remote attackers can potentially access, modify, or delete database contents. All installations of version 1.0 are affected.
💻 Affected Systems
- code-projects Online Reviewer System
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized data access, privilege escalation, or database manipulation leading to system compromise.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Public exploit available on GitHub, remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Implement input validation and parameterized queries in loaddata.php.
🔧 Temporary Workarounds
Input Validation Workaround
allAdd input validation to sanitize difficulty_id parameter before SQL query execution.
Edit /system/system/admins/assessments/pretest/loaddata.php to validate difficulty_id as integer
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting difficulty_id parameter.
Configure WAF to block patterns like UNION SELECT, OR 1=1, --, ;, etc.
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only.
- Implement strict network segmentation and monitor all traffic to the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Test the /system/system/admins/assessments/pretest/loaddata.php endpoint with SQL injection payloads in difficulty_id parameter.Check Version:
Check system documentation or configuration files for version information.Verify Fix Applied:
Verify that SQL injection payloads no longer execute and return proper error handling.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to loaddata.php with suspicious parameters
Network Indicators:
- SQL injection patterns in HTTP requests to loaddata.php
- Unusual database query patterns from web server
SIEM Query:
source="web_logs" AND uri="/system/system/admins/assessments/pretest/loaddata.php" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT" OR query CONTAINS "--" OR query CONTAINS ";")