Description
A vulnerability was determined in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/admins/assessments/pretest/exam-delete.php. This manipulation of the argument test_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-02-09
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection leading to potential data compromise
Action: Patch
AI Analysis

Impact

A flaw exists in the admin exam-delete.php script of code‑projects Online Reviewer System 1.0 that allows a remote attacker to manipulate the test_id parameter and inject arbitrary SQL. This flaw can be used to read, modify, or delete database records associated with exam assessments, thereby compromising data integrity and confidentiality.

Affected Systems

The vulnerability affects code‑projects Online Reviewer System version 1.0. No other versions or products were listed as impacted.

Risk and Exploitability

The flaw carries a CVSS score of 6.9, indicating moderate severity. EPSS shows less than 1 % probability of exploitation, and the issue is not currently recorded in CISA’s KEV catalog, suggesting no known widespread attacks. Nevertheless, the exploit can be launched remotely against the admin exams module, and because it targets a database operation, based on the description, it is inferred that an attacker with sufficient privileges could exfiltrate sensitive data or alter critical exam information. The potential impact is significant, especially for systems that store confidential assessment data.

Generated by OpenCVE AI on April 18, 2026 at 13:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the most recent release of code‑projects Online Reviewer System that addresses the SQL injection in exam-delete.php.
  • Restrict access to the /system/system/admins/assessments/pretest/ directory so that only authenticated administrators can reach exam-delete.php.
  • Implement input validation or replace concatenated SQL with parameterized queries for the test_id parameter to eliminate the injection vector.
  • Deploy a web application firewall to detect and block suspicious SQL payloads.

Generated by OpenCVE AI on April 18, 2026 at 13:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Fabian
Fabian online Reviewer System
CPEs cpe:2.3:a:fabian:online_reviewer_system:1.0:*:*:*:*:*:*:*
Vendors & Products Fabian
Fabian online Reviewer System

Mon, 09 Feb 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects online Reviewer System
Vendors & Products Code-projects
Code-projects online Reviewer System

Mon, 09 Feb 2026 00:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/admins/assessments/pretest/exam-delete.php. This manipulation of the argument test_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Title code-projects Online Reviewer System exam-delete.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Reviewer System
Fabian Online Reviewer System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:52:15.433Z

Reserved: 2026-02-07T17:36:20.286Z

Link: CVE-2026-2197

cve-icon Vulnrichment

Updated: 2026-02-09T20:48:29.537Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-09T01:16:03.857

Modified: 2026-02-10T15:08:01.180

Link: CVE-2026-2197

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T13:15:25Z

Weaknesses