CVE-2026-2198: code-projects Online Reviewer System 1.0 SQL Injection in loaddata.php
CVE-2026-2198 is a SQL injection weakness (CWE-89) in code-projects Online Reviewer System 1.0, reachable through the difficulty_id argument of a PHP file in the admin assessments area. NVD rates it 9.8 (critical) under CVSS 3.1 with no privileges or user interaction required. The record says a public exploit exists, but the CVE is not listed in CISA KEV and no fixed version is listed.
Overview
CVE-2026-2198 describes a SQL injection weakness (CWE-89) in code-projects Online Reviewer System 1.0. The affected code is in the file /system/system/admins/assessments/pretest/loaddata.php and is tied to the difficulty_id argument. The record describes the issue as remotely reachable.
Impact
- NVD scores the issue 9.8 (critical) under CVSS 3.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network access, no privileges, no user interaction and high confidentiality, integrity and availability impact.
- SQL injection in general can allow unauthorized reading or alteration of database content; the concrete impact in this application is not described in the record.
- CNA VulDB scores in the record differ: 7.3 (3.1), 7.5 (2.0) and 5.5 (4.0).
Affected products and versions
- The affected field lists Fabian Online Reviewer System, version 1.0, while the description names code-projects Online Reviewer System 1.0. The naming difference is unresolved in the record.
- No fixed version is listed in the record.
- Product reference: code-projects.
Exploitation status
- The record states that the exploit is publicly available and might be used.
- The CVE is not listed in CISA KEV in the record, so this analysis does not state active exploitation or exploitation in the wild.
- The record gives an EPSS probability of 0.00429 and a percentile of 0.35405.
Remediation and mitigation
- No vendor fix is listed in the sources consulted. Confirm the status with the vendor or project maintainers before relying on any update.
- Restrict network access to the administrative paths of the application, including the assessments module.
- Review the input handling for difficulty_id and move the affected database queries to parameterized statements with strict input validation.
- If the application cannot be fixed or verified, consider taking it offline or isolating it from untrusted networks.
Detection guidance
- Review web server logs for unusual or malformed requests to the loaddata.php path, especially with abnormal values in the difficulty_id parameter.
- Monitor database error messages that originate from this application.
- Audit administrative area access and look for unexpected sessions or data changes.
Limitations of the available information
- The record includes no vendor advisory, no patch and no affected version range beyond version 1.0.
- The product name differs between the affected field and the description.
- A VulDB reference carries a Permissions Required tag, which the record does not explain; it conflicts in appearance with the PR:N value in the NVD vector.
- The EPSS date in the record is later than the publication date, so the EPSS figures should be treated with caution.
Frequently asked questions
Is CVE-2026-2198 being actively exploited?
The record does not list the CVE in CISA KEV and does not confirm active exploitation or exploitation in the wild. It does state that a public exploit is available and might be used.
Is there a fixed version for this issue?
No fixed version is listed in the record or in the sources consulted. Confirm the status with the vendor or project maintainers.
What should defenders do now?
Restrict network access to the affected application, review handling of the difficulty_id input, check logs for unusual requests to loaddata.php, and isolate the application if it cannot be verified as fixed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.