CVE-2026-14657: SQL Injection in Assessment Management 1.0 Marking Scheme Handler

Technical summary

CVE-2026-14657 is a SQL injection flaw in the Database Query Handler component of Assessment Management 1.0. The vulnerability exists in /lecturer/marking-scheme.php where the squestions[] argument is improperly sanitized before being used in a database query. An authenticated attacker can craft a malicious request to execute arbitrary SQL commands. The issue is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-89 (SQL Injection), indicating both inadequate input validation and parameterization failures.

Business impact

This vulnerability could allow a compromised or malicious lecturer account to exfiltrate sensitive assessment data, including student responses and grades, or to modify marking schemes and results. Organizations using Assessment Management 1.0 for course delivery face potential data integrity issues, regulatory compliance violations if student records are altered, and reputational harm. The attack surface is limited to authenticated users with lecturer privileges, but institutional staff turnover and credential compromise are realistic threat scenarios.

Affected systems

code-projects Assessment Management version 1.0 is affected. Organizations running this specific version should immediately inventory their deployments. The vulnerability affects the lecturer interface, so exposure is limited to accounts with assessment marking privileges.

Exploitability

The vulnerability is remotely exploitable but requires valid authentication credentials. The published exploit code increases risk by reducing the technical barrier to attack, though an attacker must first obtain or compromise a lecturer account. The requirement for authentication moderates the overall exploitability compared to unauthenticated SQL injection vulnerabilities. However, once inside, the attack requires no user interaction and can be automated.

Remediation

Upgrade to a patched version of Assessment Management beyond 1.0. Verify the availability of security updates directly from the code-projects vendor. In parallel, implement database-level access controls to limit lecturer account privileges to only necessary tables, and deploy Web Application Firewall rules to detect and block SQL injection patterns in the marking-scheme.php endpoint. Monitor database query logs for suspicious activity.

Patch guidance

Check the code-projects vendor advisory for the recommended upgrade path from version 1.0. Apply patches during a maintenance window to minimize disruption to active assessments. After patching, verify the fix by testing the marking-scheme.php endpoint with known SQL injection payloads in a non-production environment. Document the patch version applied for compliance and audit purposes.

Detection guidance

Monitor access logs for /lecturer/marking-scheme.php requests containing SQL-like syntax in the squestions[] parameter (e.g., UNION, SELECT, OR 1=1). Database query logs should be reviewed for unusual SQL patterns originating from lecturer accounts. Intrusion detection systems should be tuned to flag SQL injection attempts. Additionally, track changes to marking schemes and grades for anomalies, particularly outside normal grading windows.

Why prioritize this

Although classified as MEDIUM severity due to the authentication requirement, this vulnerability warrants prompt attention because SQL injection remains a high-impact attack vector, an exploit is publicly available, and Assessment Management systems hold sensitive student data protected by educational privacy regulations. Organizations should prioritize patching within their normal update cadence, accelerating if lecturer accounts show signs of compromise.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects a network-accessible vulnerability requiring low attack complexity and user authentication, with low impact to confidentiality, integrity, and availability within the user's session context. However, the practical impact is significant because the target asset (student assessment records) is sensitive, the published exploit accelerates discovery, and authentication bypass via credential compromise is plausible.

Frequently asked questions