CVE-2026-14658: SQL Injection in code-projects Assessment Management 1.0

Technical summary

CVE-2026-14658 is a SQL injection flaw (CWE-89, CWE-74) in the /lecturer/marking-scheme.php endpoint of Assessment Management 1.0. The application fails to properly sanitize or parameterize the smarksrange[] parameter before incorporating it into SQL queries. The vulnerability requires authenticated access (PR:L in CVSS) and can be triggered over the network without user interaction. The attack vector is straightforward: inject SQL metacharacters into the smarksrange array to break query logic and execute unintended commands.

Business impact

Depending on database permissions and data sensitivity, an authenticated educator or administrator could extract grade records, student personal information, or other sensitive academic data. An attacker could also modify grades or delete assessment records, compromising academic integrity and institutional trust. The public exploit status means threat actors may already be scanning educational institutions running this version.

Affected systems

code-projects Assessment Management version 1.0 is affected. No other versions are documented in available advisories; verify with the vendor whether later releases or patches are available. Organizations running this assessment tool in production environments should inventory affected instances immediately.

Exploitability

The vulnerability has a CVSS score of 6.3 (MEDIUM) with network accessibility and low complexity, but requires valid login credentials to exploit. Public exploits are now available, which reduces the barrier to attack significantly. Any authenticated user with access to the marking scheme interface can attempt exploitation. The lack of complexity in the injection—likely involving simple SQL comment sequences or UNION-based queries—means exploitation does not require sophisticated technical skill.

Remediation

Contact code-projects immediately to determine whether a patched version is available. If no official patch exists, consider isolating the Assessment Management instance to a segregated network segment, restricting access by IP or VPN, and applying web application firewall rules to block common SQL injection payloads in the smarksrange[] parameter. As a temporary measure, disable the marking-scheme.php endpoint if functionality is not critical.

Patch guidance

Check the code-projects advisory and support portal for version 1.0.1 or later. Apply patches as soon as they become available. If the vendor has discontinued support for version 1.0 without providing a fix, evaluate migration to a maintained fork or alternative assessment platform. Document the patch version applied and test thoroughly in a staging environment before production deployment.

Detection guidance

Monitor application logs for SQL error messages or unusual query patterns in requests to /lecturer/marking-scheme.php. Look for smarksrange[] parameters containing SQL metacharacters such as single quotes, double dashes, semicolons, or UNION keywords. Web application firewalls should flag payloads matching SQL injection signatures. Check database audit logs for unexpected SELECT, UPDATE, or DELETE operations originating from the Assessment Management application. Implement rate-limiting on the marking-scheme endpoint to reduce brute-force exploitation attempts.

Why prioritize this

Although the CVSS score is medium, the practical risk is elevated due to public exploit availability, the sensitivity of academic data, and the authenticated-access requirement that many educational staff will satisfy. Institutions should prioritize this because compromise of assessment data affects institutional credibility and student records. The short window between public disclosure and widespread scanning favors rapid remediation.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects the requirements for authentication (PR:L) and the confidentiality, integrity, and availability impacts at the user scope level. The score does not account for the amplified practical risk from public exploits. In real-world assessment of educational institutions, this vulnerability warrants urgent action due to data sensitivity and the likelihood that exploit code is already being deployed.

Frequently asked questions