Description

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/course/btn_functions.php. This manipulation of the argument Course causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-20T03:16:31.513Z",
  "pubdate": "2026-09-20T03:16:31.513Z",
  "executiveSummary": "The Online Reviewer Management System 1.0 contains a critical SQL injection vulnerability within the /reviewer_0/admins/assessments/course/btn_functions.php file. This security flaw stems from the improper sanitization of user-supplied input provided via the 'Course' argument.\nA remote, unauthenticated attacker can exploit this vulnerability to manipulate backend database queries, potentially leading to unauthorized data disclosure, modification, or deletion. The vulnerability poses a significant risk to the confidentiality, integrity, and availability of the system's database. Because the exploit is publicly disclosed, the probability of active exploitation is high. Organizations utilizing this software are strongly advised to remediate the vulnerable code to prevent unauthorized database access.",
  "technicalDetails": "The vulnerability resides in the /reviewer_0/admins/assessments/course/btn_functions.php script of the Online Reviewer Management System 1.0. The root cause of this issue is the application's failure to adequately validate or parameterize input passed through the 'Course' argument before incorporating it into a SQL statement.\nThis indicates that the application likely constructs its database queries by concatenating user-supplied data directly into the query string rather than utilizing prepared statements or parameterized queries. By injecting SQL meta-characters or malformed SQL commands into the 'Course' parameter, an attacker can alter the intended logic of the database query.\nThe attack flow initiates when an attacker sends a crafted HTTP request to the vulnerable endpoint /reviewer_0/admins/assessments/course/btn_functions.php. The attacker includes a malicious payload within the 'Course' argument, such as a tautology (e.g., '1=1') or a UNION-based SQL injection string. When the PHP backend processes this input, the injected SQL command is executed by the database management system (DBMS) with the privileges of the database user configured for the application.\nExploitation allows an attacker to bypass standard application access controls. Depending on the database configuration and application architecture, an attacker may extract sensitive information such as user credentials, session tokens, or private assessment data. In more severe scenarios, if the database user possesses sufficient privileges, an attacker might be able to modify, delete, or drop tables, leading to a complete compromise of the application's data layer. Because this interface is reachable over the network, no physical access is required. The lack of robust input validation mechanisms and the reliance on insecure query construction techniques make this component highly susceptible to automated exploitation tools and manual crafting of malicious payloads."
}