CVE-2026-2197: Code-projects Online Reviewer System 1.0 SQL Injection
A SQL injection flaw (CWE-89) in code-projects Online Reviewer System 1.0 was reported in the exam-delete.php script, where the test_id argument is affected. NVD rates it 9.8 Critical under CVSS 3.1, and the record states that a public exploit has been disclosed. No fixed version or vendor patch is listed in the sources consulted.
Overview
A SQL injection vulnerability (CWE-89) has been reported in code-projects Online Reviewer System 1.0. The affected file is /system/system/admins/assessments/pretest/exam-delete.php, and the record states that the test_id argument is involved. Details are published in VulDB and summarized in the NVD entry.
Impact
- NVD assigns CVSS 3.1 base score 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes high confidentiality, integrity and availability impact if the vector is accurate.
- Other scores from the CNA differ: 7.3 under 3.1, 7.5 under 2.0 and 5.5 under 4.0.
- SQL injection can allow an attacker to read, alter or delete database content, depending on the application and database configuration. The record does not confirm which of these outcomes is possible here.
Affected products and versions
- The record lists the affected product as Fabian Online Reviewer System, version 1.0, while the description names code-projects Online Reviewer System 1.0. This naming mismatch should be verified against the vendor site.
- No fixed version is listed. The fixes field is empty, which means the fix status is unknown, not confirmed absent.
Exploitation status
- The record marks the CVE as not listed in the CISA KEV catalog, so active exploitation is not confirmed by that source.
- The description states that the exploit has been publicly disclosed. A GitHub issue tagged as Exploit is referenced in the record at GitHub issue 18.
- No confirmed exploitation in the wild appears in the sources consulted.
- The EPSS probability is 0.00376 with percentile 0.29665, as recorded.
Remediation and mitigation
- Check with the vendor or project maintainers for a corrected release. No fix is documented in the record.
- Restrict access to administrative paths, including the assessments area, to trusted networks and accounts until a fix is verified.
- Ask the developers to use parameterized queries and server-side validation for all identifiers received by the affected script.
- Consider temporarily disabling or isolating the application if it is not essential, and apply least-privilege rules to the database account it uses.
Detection guidance
- Review web server logs for requests to the affected path, especially those with unusual or malformed values in the test_id parameter.
- Watch for database error messages or spikes in query failures originating from the application.
- Monitor for unexpected data access or changes in the application database.
Limitations of the available information
- The record does not provide a fixed version, patch, or vendor advisory.
- The affected version range beyond version 1.0 is unknown.
- The product name differs between the affected list and the description.
- One VulDB reference is tagged Permissions Required, which may conflict with the PR:N value in the NVD vector. Whether authentication is needed is unknown.
- CNA scores differ from the NVD score, and the basis for each is not stated in the record.
Frequently asked questions
Is CVE-2026-2197 known to be actively exploited?
The record marks it as not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The description states that a public exploit has been disclosed.
Is there a fixed version of the affected software?
No fixed version is listed in the record. The status is unknown, so check with the vendor or project maintainers and apply compensating controls meanwhile.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.