CVE-2026-2223: code-projects Online Reviewer System 1.0 SQL Injection (CWE-89)
A SQL injection vulnerability (CWE-89) has been reported in code-projects Online Reviewer System 1.0, where the ID argument of a student assessment page can influence database queries. The record states that the attack can be launched remotely and that the exploit has been publicly disclosed. NVD lists a CVSS 3.1 base score of 9.8, and the record does not show confirmed exploitation in the wild.
Overview
A SQL injection flaw (CWE-89) has been reported in code-projects Online Reviewer System 1.0. According to the record, the issue is in index.php under the student assessments pretest section, where user-supplied input in the ID argument can affect database queries. Sources include the VulDB entry and the NVD record.
Impact
- NVD scores this issue 9.8 under CVSS 3.1, with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
- In general terms, SQL injection can allow unauthorized reading or modification of database content and may disrupt application availability.
- The CNA scores in the record are lower: 7.3 under 3.1, 5.5 under 4.0 and 7.5 under 2.0. The severity therefore depends on which scoring source is used.
Affected products and versions
- The description names code-projects Online Reviewer System 1.0.
- The structured affected-product field names Fabian Online Reviewer System, version 1.0. This naming mismatch should be checked against the project website.
- The record lists no fixed version. This does not mean that no fix exists.
Exploitation status
- The record shows this CVE is not listed in CISA KEV, so active exploitation is not confirmed by that catalog.
- The description states that the exploit has been publicly disclosed and may be used. A GitHub issue is tagged as an exploit reference.
- The EPSS probability is 0.0049 with percentile 0.40463. This is a statistical estimate and not evidence of observed attacks.
Remediation and mitigation
- Inventory all deployments of the Online Reviewer System and determine whether the affected page is reachable from untrusted networks.
- Restrict access to trusted users or internal networks until a verified fix or code review is completed.
- Apply a vendor or maintainer fix when one becomes available. If none exists, consider replacing or removing the component.
- Use parameterized database queries for user-supplied identifiers and apply least-privilege database accounts.
Detection guidance
- Review web server and application logs for unusual or malformed values in parameters sent to the affected page.
- Monitor for database error messages returned to clients and for unexpected request spikes to assessment pages.
- Consider web application firewall rules as a temporary compensating control, tested for false positives.
Limitations of the available information
- The record does not list fixed versions, patches or vendor advisories.
- The product name differs between the description and the affected-product field.
- The sources consulted do not show how widely this software is deployed.
- The EPSS date in the record (2026-10-13) is later than the publication date and should be verified.
Frequently asked questions
Is this CVE confirmed as actively exploited?
The record does not list it in CISA KEV, so active exploitation is not confirmed by the sources consulted. The description does state that a public exploit has been disclosed and may be used.
Is a fixed version available?
The record lists no fixed version. Check the project and vendor pages, and apply compensating controls such as restricted access until a verified fix is available.
Why do the severity scores differ?
NVD gives a CVSS 3.1 score of 9.8, while the CNA VulDB scores in the record are 7.3 under 3.1, 5.5 under 4.0 and 7.5 under 2.0. Each score comes from a different source and version.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.