CVE-2026-2198 identifies a SQL Injection vulnerability in the Online Reviewer System version 1.0 developed by code-projects. The vulnerability resides in an unspecified function within the file /system/system/admins/assessments/pretest/loaddata.php, where the difficulty_id parameter is improperly sanitized. This lack of input validation allows an attacker to inject malicious SQL code remotely without authentication or user interaction. The injection can manipulate backend SQL queries, potentially exposing sensitive data, altering database contents, or disrupting service availability. The CVSS 4.0 score of 6.9 reflects a medium severity, considering the network attack vector, no required privileges, and no user interaction, but limited impact on confidentiality, integrity, and availability. No patches have been officially released yet, and no active exploitation has been reported, though a public exploit exists. The vulnerability is critical for environments relying on this system for assessments or reviews, as attackers could extract confidential information or corrupt assessment data. The absence of secure coding practices in input handling is the root cause. Remediation requires code fixes to properly sanitize and parameterize SQL queries, preventing injection attacks.

For European organizations using the code-projects Online Reviewer System 1.0, this vulnerability poses risks of unauthorized data access, data manipulation, and potential service disruption. Educational institutions, certification bodies, and companies relying on this system for assessments could face confidentiality breaches of sensitive user data or exam content. Integrity of assessment results could be compromised, undermining trust and compliance with data protection regulations such as GDPR. Availability impacts are likely limited but could occur if attackers exploit the vulnerability to cause database errors or denial of service. The medium severity suggests a moderate risk, but the ease of remote exploitation without authentication increases urgency. Organizations may also face reputational damage and regulatory penalties if data breaches occur. The lack of known active exploitation provides a window for mitigation, but the public exploit availability increases the likelihood of future attacks.

1. Immediately implement input validation and sanitization for the difficulty_id parameter, ensuring only expected data types and values are accepted. 2. Employ prepared statements or parameterized queries in the affected PHP code to prevent SQL injection. 3. Deploy a Web Application Firewall (WAF) with rules targeting SQL injection patterns to block malicious requests. 4. Monitor database logs and web server logs for unusual query patterns or repeated failed attempts targeting the vulnerability. 5. Restrict database user permissions to the minimum necessary to limit the impact of any injection attack. 6. If patching is not immediately possible, consider isolating the vulnerable system from external network access or restricting access to trusted IPs. 7. Educate developers and administrators on secure coding practices and conduct code reviews to identify similar vulnerabilities. 8. Plan and test a patch deployment as soon as an official fix becomes available from the vendor or community.