CVE-2026-2223 is a high severity SQL injection flaw (CVSS 7.3) in the student pretest page of code-projects Online Reviewer System 1.0. The ID argument is built into a query unsafely and the page can be reached remotely. The record lists no fix, so restrict access and ask the maintainer about a patch.
What's affected
Online Reviewer System 1.0 from code-projects. The affected file is /system/system/students/assessments/pretest/take/index.php, and the argument is ID.
The record lists no fixed version and no vendor advisory. Its references are a public GitHub issue and VulDB entries.
How to check if you're exposed
This is a downloadable PHP project, so you are exposed only if you installed and run it. Look for the vulnerable file in your web root and confirm the version in the project files.
find /path/to/web/root -path "*students/assessments/pretest/take*" -name index.php
If the site is reachable from the internet, assume it is exposed. The CVSS vector shows network access, low complexity, no privileges required and no user interaction.
What to do now
- Take the application off the public internet, or put it behind a VPN or an IP allowlist, until you have a fix.
- Contact the project through its website and ask for a patched release or guidance. The record lists none.
- If you maintain a copy, change the vulnerable query to use prepared statements with bound parameters instead of building SQL from request input.
- Back up the database, then review web server and database logs for unusual requests to the affected page.
- Remove demo or coursework projects from production hosts. If you need the function, rebuild it on a maintained framework.
Why it matters
This is the third SQL injection reported against the same application on the same day, after the admin pretest function and the login page. Several in one codebase usually means the pattern of building queries from input is used throughout, so fixing one file will not be enough.
SQL injection happens when request input is placed into a query string and the database cannot tell the data from the command. The weaknesses mapped to this record are CWE-74 and CWE-89. Each impact score is low, which is why the base score is 7.3 and not higher.
The record says an exploit is publicly available. It does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
Quick check
Is this flaw being exploited in the wild?
The record says exploit details are public, but the CVE is not on the CISA Known Exploited Vulnerabilities list. Public details still make scanning for it more likely.
Is there a patched version?
The record does not list one. Ask the maintainer, and do not assume a newer download fixes it without checking.
Sources
Last reviewed: 19 October 2026.
