CVE-2026-14658 Overview
CVE-2026-14658 is a SQL injection vulnerability affecting code-projects Assessment Management 1.0. The flaw resides in the /lecturer/marking-scheme.php script, where the smarksrange[] parameter is passed to a backend database query without proper sanitization. An authenticated remote attacker can inject arbitrary SQL statements through this parameter. The exploit has been disclosed publicly and may be used against exposed installations. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Although the impact is scoped as low across confidentiality, integrity, and availability, exploitation still provides adversaries a foothold to enumerate or manipulate application data.
Critical Impact
Authenticated remote attackers can inject SQL through the smarksrange[] parameter in marking-scheme.php, enabling unauthorized read or modification of Assessment Management database records.
Affected Products
- code-projects Assessment Management 1.0
- /lecturer/marking-scheme.php endpoint
- Deployments exposing the lecturer interface to untrusted networks
Discovery Timeline
- 2026-07-04 - CVE-2026-14658 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-14658
Vulnerability Analysis
The vulnerability exists in the lecturer-facing marking scheme handler of code-projects Assessment Management 1.0. The application accepts the smarksrange[] array parameter from HTTP requests and concatenates its values directly into a SQL statement. Because the input is neither parameterized nor escaped, an attacker controlling the parameter can break out of the intended query context. This allows the injection of additional SQL clauses such as UNION SELECT, boolean-based conditions, or time-based payloads. The endpoint requires an authenticated lecturer session, which raises the attack barrier, but valid credentials are common in shared academic environments. Public disclosure of the technique lowers the effort needed to reproduce the attack.
Root Cause
The root cause is improper neutralization of user-supplied input before it is used in a database query, consistent with [CWE-74]. The smarksrange[] array is inserted into the SQL string without prepared statements or type validation. PHP's loose handling of array parameters compounds the issue, as each array element becomes an injection point.
Attack Vector
Exploitation is performed remotely over the network against the /lecturer/marking-scheme.php endpoint. The attacker submits a crafted POST or GET request in which one or more smarksrange[] entries contain SQL metacharacters. The malicious payload is evaluated by the database engine, allowing extraction of records from tables such as user accounts, assessments, or grades. Automated tooling such as sqlmap can be pointed at the vulnerable parameter to enumerate the schema without manual crafting.
No verified proof-of-concept code is republished here. Refer to the GitHub CVE Assessment Document and VulDB CVE-2026-14658 entry for the disclosed technique.
Detection Methods for CVE-2026-14658
Indicators of Compromise
- HTTP requests to /lecturer/marking-scheme.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or information_schema within smarksrange[] values.
- Web server or application logs showing repeated 500-series errors originating from the marking scheme endpoint.
- Database error messages referencing syntax failures in queries built from smarksrange inputs.
Detection Strategies
- Deploy Web Application Firewall (WAF) signatures that inspect array parameters for SQL injection patterns targeting the affected script path.
- Enable database query logging and alert on unexpected UNION, SLEEP, or schema enumeration queries originating from the Assessment Management service account.
- Review authentication logs to correlate lecturer sessions with anomalous request volumes to marking-scheme.php.
Monitoring Recommendations
- Aggregate PHP and database logs into a centralized platform and alert on repeated query parse errors from a single session.
- Baseline normal smarksrange[] value length and character set, then flag deviations that include quotes, comments, or SQL keywords.
- Track outbound data volume from the database host to detect bulk extraction attempts following successful injection.
How to Mitigate CVE-2026-14658
Immediate Actions Required
- Restrict access to /lecturer/marking-scheme.php to trusted internal networks or VPN users until a fix is available.
- Rotate lecturer account credentials and enforce strong password policies to limit the pool of accounts able to reach the vulnerable endpoint.
- Deploy WAF rules that block SQL metacharacters in smarksrange[] array parameters.
Patch Information
At the time of publication, no official vendor patch is referenced in the NVD entry for CVE-2026-14658. Administrators should monitor the code-projects site and the VulDB advisory for updates. Where source access is available, developers should refactor the affected query to use PDO or mysqli prepared statements with bound parameters, and cast each smarksrange[] element to an integer before use.
Workarounds
- Apply server-side input validation that rejects any smarksrange[] element that is not a numeric range value.
- Enforce least-privilege database accounts so the web application cannot read tables outside the marking scheme scope.
- Disable or remove the lecturer marking scheme feature if it is not required in the deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
