CVE-2026-2912
📋 TL;DR
This SQL injection vulnerability in code-projects Online Reviewer System 1.0 allows remote attackers to manipulate database queries through the test_id parameter. Attackers can potentially read, modify, or delete database contents. All installations of version 1.0 with the vulnerable file accessible are affected.
💻 Affected Systems
- code-projects Online Reviewer System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, data manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Public exploit details exist on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries and input validation in /system/system/students/assessments/results/studentresult-view.php.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests
Input Validation
allAdd server-side validation to ensure test_id parameter contains only expected values
🧯 If You Can't Patch
- Restrict access to the vulnerable endpoint using network ACLs or authentication
- Implement database user with minimal privileges (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test the /system/system/students/assessments/results/studentresult-view.php endpoint with SQL injection payloads in test_id parameterCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests with SQL keywords in parameters
- Requests to studentresult-view.php with suspicious test_id values
Network Indicators:
- HTTP requests containing SQL injection patterns in test_id parameter
- Unusual database query patterns from application server
SIEM Query:
web.url:*studentresult-view.php* AND (web.param.test_id:*UNION* OR web.param.test_id:*SELECT* OR web.param.test_id:*OR*1=1*)