CVE-2026-2173: Code-projects Online Examination System 1.0 SQL Injection in login.php

Overview

CVE-2026-2173 is an SQL injection weakness (CWE-89) in the login.php file of code-projects Online Examination System 1.0, as described in the record. The description refers only to some unknown functionality of login.php and says manipulation of the username and password arguments leads to SQL injection. The attack may be initiated remotely.

Impact

NVD assigns a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network-reachable attack with low complexity, no privileges and no user interaction, and high impact to confidentiality, integrity and availability. The CNA (VulDB) lists different scores: 7.3 under CVSS 3.1, 6.9 under CVSS 4.0 and 7.5 under CVSS 2.0. Based on the description, an attacker could potentially read or change database content through the login form, but the record does not describe the observed consequences.

Affected products and versions

• The description names code-projects Online Examination System 1.0.
• The structured affected-product field names Fabian Online Examination System, version 1.0. This naming difference is not resolved by the record.
• No other affected versions are listed in the record.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00363 with a percentile of 0.28292, as recorded with date 2026-10-13. These figures indicate a low modelled likelihood of exploitation, but they are not evidence of actual attacks.

Remediation and mitigation

• The record lists no fixed version and no vendor patch. The absence of a listed fix does not mean none exists; check the vendor and the product page for updates.
• If the application is in use, restrict access to the login interface, keep it off direct internet exposure, and place it behind network controls where feasible.
• Remove or replace the application if no supported fixed version is available.
• Code maintainers should use parameterized queries and strict input validation for authentication fields.

Detection guidance

• Review web server and application logs for unusual or malformed requests to login.php, especially with anomalous content in username or password fields.
• Watch for database error messages returned to users or unexpected authentication successes.
• Use web application firewall or intrusion detection alerts for SQL injection signatures, recognizing that these are not comprehensive.

Limitations of the available information

• The record does not identify the vulnerable function, the exact code path or the vendor fix status.
• The product name differs between the description and the affected field.
• One VulDB reference carries the tag Permissions Required, while the description and NVD vector indicate no privileges are needed. This conflict is not resolved by the record.
• No fixed version, patch or vendor advisory is provided.

Frequently asked questions

What is CVE-2026-2173?

It is an SQL injection weakness (CWE-89) in login.php of code-projects Online Examination System 1.0, triggered through the username and password arguments, according to the record.

How severe is it?

NVD rates it 9.8 critical under CVSS 3.1. The CNA VulDB scores are lower, at 7.3 under CVSS 3.1, 6.9 under CVSS 4.0 and 7.5 under CVSS 2.0.

Is there a fix?

The record lists no fixed version or vendor patch. Check the vendor and product pages for updates and consider restricting access in the meantime.

Is it known to be exploited?

The CISA KEV catalog does not list it in the record, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.