CVE-2026-2196 in Online Reviewer System
Summary
by MITRE • 02/09/2026
A vulnerability was found in code-projects Online Reviewer System 1.0. This issue affects some unknown processing of the file /system/system/admins/assessments/pretest/exam-update.php. The manipulation of the argument test_id results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/11/2026
This vulnerability resides within the code-projects Online Reviewer System version 1.0 where an insecure data handling mechanism exists in the file /system/system/admins/assessments/pretest/exam-update.php. The flaw manifests when the application processes the test_id parameter without adequate input validation or sanitization, creating an avenue for malicious actors to inject arbitrary SQL commands into the database query execution flow. The vulnerability classifies as a classic sql injection flaw that allows attackers to manipulate the underlying database structure and potentially extract sensitive information from the system.
The technical exploitation of this vulnerability occurs through remote code execution capabilities where an attacker can manipulate the test_id argument to inject malicious sql payloads. This allows for unauthorized access to database contents, including user credentials, system configurations, and potentially full database compromise. The attack vector is particularly dangerous because it can be executed without requiring local system access, making it a remotely exploitable vulnerability that could be leveraged by threat actors with minimal technical expertise. The public availability of exploit code significantly increases the risk profile as it removes the need for custom development of attack mechanisms.
The operational impact of this vulnerability extends beyond simple data theft to include complete system compromise and potential denial of service conditions. Attackers could use the sql injection to escalate privileges, modify existing database entries, create new user accounts with administrative rights, or even delete critical system data. The vulnerability affects the integrity and confidentiality of the entire online reviewer system, potentially exposing sensitive educational content and user information. Organizations relying on this system face significant risk of data breaches and regulatory compliance violations that could result in substantial financial and reputational damage.
Mitigation strategies should prioritize immediate patching of the vulnerable application version to address the input validation deficiency in the exam-update.php file. Implementing proper parameterized queries and input sanitization mechanisms would prevent sql injection attacks from succeeding. Network-level protections such as web application firewalls and intrusion detection systems should be deployed to monitor for suspicious sql injection patterns. Additionally, regular security assessments and code reviews should be conducted to identify similar vulnerabilities in other application components. Organizations should follow established security frameworks like the CWE top 25 vulnerabilities list and implement controls aligned with the ATT&CK framework's database access tactics to prevent such exploitation scenarios. Access controls and least privilege principles should be enforced to limit the potential damage from successful exploitation attempts.