CVE-2026-14657: Assessment Management 1.0 SQLi Vulnerability

CVE-2026-14657 Overview

CVE-2026-14657 is a SQL injection vulnerability in code-projects Assessment Management 1.0. The flaw resides in the /lecturer/marking-scheme.php script, which is part of the application's Database Query Handler component. Attackers can manipulate the squestions[] parameter to inject arbitrary SQL statements into backend database queries. The issue requires low-privileged authenticated access and can be triggered remotely over the network. A public exploit has been released, increasing the likelihood of opportunistic scanning and reuse against exposed installations. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Authenticated remote attackers can inject SQL through the squestions[] parameter in marking-scheme.php, exposing assessment data stored in the backend database.

Affected Products

code-projects Assessment Management 1.0
Component: Database Query Handler (/lecturer/marking-scheme.php)
Parameter: squestions[]

Discovery Timeline

2026-07-04 - CVE-2026-14657 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14657

Vulnerability Analysis

The vulnerability lives in the lecturer-side marking scheme workflow of Assessment Management 1.0. When a request reaches /lecturer/marking-scheme.php, the application forwards values from the squestions[] array parameter directly into a SQL statement handled by the Database Query Handler. Because the parameter is an array, each element is concatenated into the query without parameterization or sanitization. An authenticated user with lecturer-level access can therefore inject SQL syntax such as UNION SELECT payloads or boolean-based conditions. Successful exploitation lets the attacker read, modify, or delete records tied to assessments, questions, marks, and user data. Public disclosure includes proof-of-concept details, meaning weaponization requires minimal effort.

Root Cause

The root cause is missing input neutralization on array-type request parameters. The squestions[] values are inserted into a dynamically built SQL string rather than bound through prepared statements. No allow-listing, type casting, or escaping is applied before the values reach the database driver, satisfying the conditions described by [CWE-74].

Attack Vector

Exploitation occurs remotely over HTTP against a reachable instance of the application. The attacker authenticates as a lecturer, submits a crafted POST request to /lecturer/marking-scheme.php, and embeds SQL payloads within the squestions[] array elements. Because the exploit has been published, adversaries can copy known payloads to enumerate schemas, extract credentials, or pivot to further data tampering. No user interaction is required beyond the attacker's own authenticated session.

No verified exploit code is included here. Technical details of the injection path are documented in the GitHub CVE Assessment writeup and the VulDB entry for CVE-2026-14657.

Detection Methods for CVE-2026-14657

Indicators of Compromise

HTTP POST requests to /lecturer/marking-scheme.php containing SQL metacharacters (', --, UNION, SLEEP() within squestions[] values.
Web server or PHP error logs showing SQL syntax errors originating from the marking scheme endpoint.
Unexpected database read volume or long-running queries tied to the assessment schema.

Detection Strategies

Deploy web application firewall rules that inspect squestions[] array elements for SQL injection signatures.
Enable database query logging and alert on unusual UNION SELECT, INFORMATION_SCHEMA, or time-based delay patterns.
Correlate authenticated lecturer sessions with anomalous request volume against marking-scheme.php.

Monitoring Recommendations

Forward web server, PHP, and MySQL logs to a centralized analytics platform for retention and correlation.
Baseline normal marking-scheme submission behavior and alert on deviations in payload size or parameter count.
Track failed login attempts and privilege changes on lecturer accounts to catch credential abuse feeding the exploit.

How to Mitigate CVE-2026-14657

Immediate Actions Required

Restrict network exposure of Assessment Management 1.0 to trusted networks or place it behind a VPN.
Rotate lecturer account passwords and enforce strong authentication to reduce the pool of usable attacker sessions.
Deploy a WAF signature blocking SQL metacharacters in the squestions[] parameter until code fixes are applied.

Patch Information

No official vendor patch is referenced in the advisory data. Operators should monitor the code-projects resource hub and the VulDB record for CVE-2026-14657 for updates. Until a fix ships, apply source-level remediation by refactoring the query in /lecturer/marking-scheme.php to use parameterized statements (for example, PDO prepare() with bound parameters) and validate that each squestions[] element is an integer or expected token.

Workarounds

Implement server-side input validation that rejects non-numeric values in squestions[] before database interaction.
Apply least-privilege database credentials so the web application account cannot read or alter sensitive tables beyond its needs.
Disable or remove the marking-scheme feature temporarily if it is not required for current operations.

bash

# Example ModSecurity rule to block SQLi patterns in squestions[] parameters
SecRule ARGS_NAMES "@rx ^squestions\[\]$" \
    "chain,phase:2,deny,status:403,id:1026014657,\
    msg:'Potential SQLi against marking-scheme.php (CVE-2026-14657)'"
    SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--\s|';)" "t:none"