CVE-2026-15137: SQL Injection in code-projects Interview Management System 1.0

Technical summary

CVE-2026-15137 is a SQL injection flaw in code-projects Interview Management System 1.0, specifically within the View.php file located in the \inc\classes\ directory. The vulnerability stems from insufficient input validation on the ID argument, allowing an unauthenticated attacker to craft malicious SQL queries that execute in the application's database context. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (SQL Injection), indicating a failure to properly sanitize or parameterize user-supplied input before database operations. With a CVSS 3.1 score of 7.3 (HIGH severity) and a network-accessible attack vector requiring no privileges or user interaction, this represents a significant exposure.

Business impact

Successful exploitation could allow attackers to access, modify, or delete interview records and other sensitive data stored in the application's database. Organizations using this system for candidate management could face data breaches affecting applicant information, interview notes, and hiring decisions. Unauthorized data modification could compromise the integrity of hiring workflows, while data deletion could disrupt business operations. The availability of public exploits significantly increases the likelihood and speed of opportunistic attacks.

Affected systems

code-projects Interview Management System version 1.0 is affected. Organizations running this specific version should immediately identify all instances within their environment. The application is database-backed and publicly accessible in most configurations, making it a direct target if deployed on internet-facing infrastructure.

Exploitability

This vulnerability is highly exploitable. The attack vector is network-accessible, requires no authentication or user interaction, and has low complexity—making it accessible to attackers with minimal sophistication. The public availability of exploit code removes any barrier to weaponization. An attacker simply needs to craft a malicious HTTP request with injected SQL in the ID parameter to trigger the vulnerability.

Remediation

Upgrade code-projects Interview Management System to a patched version released after the vulnerability disclosure. Verify the specific patch version against the vendor's official security advisory. As an interim measure pending patching, implement input validation and parameterized queries in View.php, restrict database account permissions to read-only where possible, and consider network segmentation to limit access to the application from untrusted networks.

Patch guidance

Contact code-projects or check their official security advisories for a patched release. Apply patches during a maintenance window after testing in a non-production environment. Verify that the patch specifically addresses SQL injection in the ID parameter of View.php. If the vendor does not provide a timely fix, consider alternative interview management solutions or implement a Web Application Firewall (WAF) rule set to block SQL injection patterns.

Detection guidance

Monitor application logs and database query logs for suspicious patterns such as UNION-based SQL injection attempts, time-based SQL inference patterns, or unusual characters (--,;,',") in the ID parameter. Deploy a WAF with SQL injection signatures to block malicious requests before they reach the application. Use intrusion detection systems to identify command-and-control communication or data exfiltration following successful exploitation. Check database audit logs for unauthorized queries or data access anomalies.

Why prioritize this

This vulnerability merits immediate attention due to the combination of high CVSS severity (7.3), unauthenticated network accessibility, low attack complexity, and public exploit availability. SQL injection vulnerabilities typically grant attackers database-level access, potentially exposing all data managed by the application. The lack of current mitigations and the presence of public proof-of-concept code mean exploitation is probable without swift remediation.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects HIGH severity driven by the network attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction needed (UI:N). The impact on confidentiality, integrity, and availability is rated as low to moderate per the vector, meaning an attacker can read sensitive data, modify records, or disrupt availability—all critical in a business application context. The public availability of exploit code further elevates operational risk beyond the base CVSS calculation.

Frequently asked questions