CVE-2026-2195 Overview
CVE-2026-2195 is a SQL injection vulnerability in code-projects Online Reviewer System 1.0, developed by Fabian. The flaw resides in /system/system/admins/assessments/pretest/questions-view.php, where the ID parameter is passed directly into a database query without proper sanitization. Remote attackers can manipulate the ID argument to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the risk of opportunistic abuse against exposed installations. The vulnerability is tracked under [CWE-89] (SQL Injection) and [CWE-74] (Improper Neutralization of Special Elements).
Critical Impact
Remote unauthenticated attackers can manipulate the ID parameter in questions-view.php to execute arbitrary SQL queries against the backend database, leading to data disclosure, modification, or further compromise.
Affected Products
- Fabian Online Reviewer System 1.0
- Component: fabian:online_reviewer_system
- Vulnerable file: /system/system/admins/assessments/pretest/questions-view.php
Discovery Timeline
- 2026-02-09 - CVE-2026-2195 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2026-2195
Vulnerability Analysis
The vulnerability exists in the administrative assessment module of Online Reviewer System 1.0. The script questions-view.php accepts an ID parameter via HTTP request and concatenates it directly into a SQL query string. Because the input is not validated, sanitized, or bound through parameterized queries, attackers can inject SQL syntax that the backend executes alongside the intended query.
The issue is reachable over the network and requires no authentication or user interaction. Public disclosure of the exploit details lowers the barrier for adversaries to weaponize the flaw against internet-exposed instances. While the impact scope per CVSS is limited in confidentiality, integrity, and availability, successful exploitation can still expose sensitive assessment data, modify records, or pivot toward broader application compromise depending on database permissions.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The application fails to use prepared statements or input validation when processing the ID parameter passed to questions-view.php. User-supplied input is treated as trusted data and concatenated into a SQL query, allowing attacker-controlled SQL fragments to alter query logic.
Attack Vector
The attack is performed remotely over HTTP. An attacker sends a crafted request to /system/system/admins/assessments/pretest/questions-view.php with a malicious ID value containing SQL metacharacters such as single quotes, UNION SELECT clauses, or boolean-based payloads. The injected SQL is executed by the database engine, enabling extraction of arbitrary table contents, authentication bypass, or modification of records. Refer to the GitHub CVE Issue Discussion and VulDB #344898 for additional technical context.
Detection Methods for CVE-2026-2195
Indicators of Compromise
- HTTP requests to /system/system/admins/assessments/pretest/questions-view.php containing SQL metacharacters in the ID parameter such as ', --, UNION, SELECT, or SLEEP(.
- Unexpected database errors or query latency originating from the questions-view.php endpoint in web server logs.
- Outbound database queries returning unusually large result sets following requests to the affected endpoint.
Detection Strategies
- Deploy web application firewall (WAF) rules to flag SQL injection patterns targeting the ID query string parameter.
- Enable database query logging and alert on queries containing suspicious UNION-based payloads or tautologies originating from the application service account.
- Correlate web access logs with database audit logs to identify anomalous query patterns triggered by single client IP addresses.
Monitoring Recommendations
- Monitor administrative URLs of the Online Reviewer System for traffic from untrusted networks and unauthenticated sessions.
- Track HTTP 500 responses and database error signatures returned by questions-view.php as early indicators of probing activity.
- Baseline normal ID parameter values (typically numeric) and alert on non-numeric or oversized input.
How to Mitigate CVE-2026-2195
Immediate Actions Required
- Restrict access to /system/system/admins/ paths to trusted administrator IP ranges using network or web server access controls.
- Place the application behind a WAF configured with SQL injection signatures until a vendor patch is available.
- Audit the database account used by the application and enforce least-privilege permissions to limit blast radius.
Patch Information
No official vendor patch has been published at the time of writing. Monitor code-projects.org and the GitHub CVE Issue Discussion for updates. Organizations should consider replacing direct SQL concatenation in questions-view.php with parameterized queries or prepared statements if maintaining the source locally.
Workarounds
- Add server-side input validation to enforce numeric-only values for the ID parameter before it reaches database logic.
- Implement prepared statements or PDO parameter binding in questions-view.php to eliminate query string concatenation.
- Disable or remove the affected administrative module if the pretest assessment functionality is not in active use.
# Example Apache mod_rewrite rule to block non-numeric ID values
RewriteEngine On
RewriteCond %{QUERY_STRING} (^|&)ID=([^0-9&]+) [NC]
RewriteRule ^system/system/admins/assessments/pretest/questions-view\.php - [F,L]
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
