CVE-2026-14706: SQL Injection in code-projects Online Examination 1.0 Quiz Creation

Technical summary

CVE-2026-14706 is a SQL injection flaw (CWE-89, CWE-74) in code-projects Online Examination 1.0's quiz creation functionality. The vulnerable endpoint /update.php?q=addquiz fails to properly sanitize or parameterize input across multiple parameters: name, total, right, wrong, time, tag, and desc. An authenticated attacker can craft SQL metacharacters within these fields to break out of intended query context and execute arbitrary database commands. The lack of prepared statements or input validation enables classic first-order SQL injection.

Business impact

An authenticated user—potentially a quiz administrator, instructor, or any user with quiz creation privileges—could escalate their access by extracting sensitive data from the examination database, including user credentials, exam answers, or grades. An attacker could also modify or delete quiz records, disrupting exam integrity and availability. In multi-tenant deployments, data exfiltration could expose information across multiple courses or institutions. Remediation delays increase exposure window for insider threats or compromised accounts.

Affected systems

code-projects Online Examination version 1.0 is explicitly affected. Organizations running this application should assume all instances are vulnerable unless patches or mitigations have been applied. The attack surface is limited to authenticated users with quiz creation permissions, but the severity is amplified in environments where those privileges are broadly delegated.

Exploitability

Exploit code is publicly available, lowering the barrier to active exploitation. However, two factors constrain widespread abuse: the vulnerability requires prior authentication (PR:L in the CVSS vector) and the attacker must have quiz creation privileges. This prevents unauthenticated remote takeovers but makes the risk acute for administrators, instructors, or compromised staff accounts. Attack complexity is low; standard SQL injection techniques apply.

Remediation

Apply a patch from code-projects that sanitizes and validates input to the quiz creation endpoint. Until patching is feasible, restrict quiz creation permissions to highly trusted users and implement database-level access controls to limit damage from compromised credentials. Input validation should reject or escape SQL metacharacters; parameterized queries (prepared statements) are the definitive fix. Monitor quiz creation logs for anomalous SQL syntax or unusual field values.

Patch guidance

Verify the latest security advisory from code-projects for patch availability and version numbers. Apply patches immediately upon release, prioritizing systems where quiz creation is frequently used. Test patches in a staging environment to confirm no regressions in quiz export, import, or reporting workflows before production deployment. If no vendor patch is available, consider upgrading to a newer version of the Online Examination platform or evaluating alternative solutions.

Detection guidance

Monitor application logs and database query logs for SQL injection attempts in /update.php?q=addquiz parameters. Look for URL-encoded SQL keywords (e.g., %27, --, OR 1=1) in the name, total, right, wrong, time, tag, or desc fields. Web application firewalls (WAF) should flag requests containing common SQL injection payloads. Baseline user privilege levels; alert on unexpected quiz creation activity from low-privilege accounts. Regular log reviews should correlate quiz creation with subsequent database schema queries or data exfiltration patterns.

Why prioritize this

This vulnerability merits prompt attention because exploit code is public and the attack surface—while limited to authenticated users—overlaps with instructor and administrator roles that are common targets for credential theft. The CVSS 6.3 MEDIUM score reflects the authentication requirement, but the confidentiality, integrity, and availability impacts justify swift patching before active exploitation in educational or corporate training environments. Non-inclusion in CISA's KEV catalog does not diminish urgency if you operate code-projects Online Examination.

Risk score, explained

CVSS 3.1 score of 6.3 (MEDIUM) reflects low attack complexity (AC:L) and network-reachable attack vector (AV:N), offset by the requirement for valid credentials (PR:L). The severity accounts for low impact on confidentiality, integrity, and availability (C:L/I:L/A:L)—typical for SQL injection in single-application scope (S:U) without lateral movement. Organizations with high-privilege quiz creators or lax password policies should weight this toward HIGH priority internally; those with strict access controls and recent password audits can maintain MEDIUM posture pending patches.

Frequently asked questions