CVE-2026-2912 identifies a SQL injection vulnerability in the Online Reviewer System version 1.0 developed by code-projects. The vulnerability exists in the /system/system/students/assessments/results/studentresult-view.php script, where the test_id parameter is not properly sanitized before being used in SQL queries. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially enabling unauthorized access to or manipulation of the backend database. The attack vector requires no privileges or user interaction, making it straightforward to exploit remotely. The vulnerability affects the confidentiality, integrity, and availability of data managed by the system. While no patches have been explicitly linked, the public disclosure of exploit code increases the urgency for remediation. The CVSS 4.0 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no authentication required (AT:N), no user interaction (UI:N), and partial impact on confidentiality, integrity, and availability (VC:L, VI:L, VA:L). This vulnerability is particularly critical for educational institutions or organizations relying on this system for assessment management, as attackers could extract sensitive student data or alter assessment results.

The exploitation of this SQL injection vulnerability can lead to unauthorized disclosure of sensitive student information, modification or deletion of assessment data, and potential disruption of the Online Reviewer System's availability. This compromises the confidentiality, integrity, and availability of critical academic records. Organizations using the affected software risk data breaches that could violate privacy regulations and damage institutional reputation. Additionally, attackers might leverage this vulnerability as a foothold for further network intrusion or lateral movement within the affected environment. The ease of remote exploitation without authentication increases the threat level, especially in environments where the system is exposed to the internet or untrusted networks.

Organizations should immediately review and sanitize all input parameters, particularly test_id, to prevent SQL injection. Implement parameterized queries or prepared statements in the affected PHP script to ensure user inputs are safely handled. If a vendor patch becomes available, apply it promptly. In the absence of a patch, consider deploying Web Application Firewalls (WAFs) with custom rules to detect and block SQL injection attempts targeting the vulnerable endpoint. Conduct thorough code audits to identify and remediate similar injection flaws elsewhere in the application. Restrict network access to the Online Reviewer System to trusted internal networks where possible, and monitor logs for suspicious query patterns or repeated access attempts to the studentresult-view.php page. Regularly back up databases to enable recovery in case of data tampering.