CVE-2026-2199
📋 TL;DR
This CVE describes a SQL injection vulnerability in code-projects Online Reviewer System 1.0. Attackers can remotely exploit the user-delete.php file by manipulating the ID parameter to execute arbitrary SQL commands. All deployments of version 1.0 are affected.
💻 Affected Systems
- code-projects Online Reviewer System
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, modification, or deletion, potentially leading to full system takeover if database privileges permit.
Likely Case
Unauthorized data access, user account manipulation, or deletion of critical system data.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Exploit details are publicly available, making attacks straightforward for threat actors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to ensure ID parameter contains only numeric values
Modify user-delete.php to validate $_GET['ID'] or $_POST['ID'] using is_numeric() or similar functions
Web Application Firewall
allDeploy WAF with SQL injection rules to block malicious requests
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement database user with minimal privileges for the application
🔍 How to Verify
Check if Vulnerable:
Test the /reviewer/system/system/admins/manage/users/user-delete.php endpoint with SQL injection payloads in the ID parameterCheck Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and proper input validation is implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed delete attempts with malformed ID parameters
Network Indicators:
- HTTP requests to user-delete.php with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="*user-delete.php*" AND (param="*UNION*" OR param="*SELECT*" OR param="*OR 1=1*")