Description

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-20T09:16:39.520Z",
  "pubdate": "2026-09-20T09:16:39.520Z",
  "executiveSummary": "The SourceCodester Online Reviewer Management System version 1.0 is susceptible to a SQL Injection (SQLi) vulnerability located within the /reviewer_0/admins/assessments/subject/btn_functions.php script.\nThis vulnerability is categorized as a SQL Injection flaw, which allows an unauthenticated or authenticated remote attacker to manipulate database queries by injecting malicious SQL statements through the 'ID' parameter.\nSuccessful exploitation of this vulnerability results in unauthorized access to the underlying database, potentially leading to data exfiltration, modification, or deletion of sensitive information.\nGiven that the exploit is currently public, the risk is elevated. Attackers can remotely initiate this exploit without requiring complex interaction beyond the manipulation of the specific URL argument.\nThe lack of proper input sanitization on the 'ID' parameter allows the attacker to break out of the intended query structure, facilitating direct interaction with the database management system.",
  "technicalDetails": "The vulnerability resides in the server-side processing of the HTTP request directed at /reviewer_0/admins/assessments/subject/btn_functions.php when the 'action' parameter is set to 'remove'. The root cause is the failure of the application to properly sanitize or parameterize the 'ID' argument before incorporating it into a database query.\nThe attack flow begins when an attacker crafts a malicious HTTP GET or POST request targeting the vulnerable file path. By manipulating the 'ID' parameter, the attacker can inject arbitrary SQL commands. Because the system does not implement prepared statements or rigorous input validation, the malicious input is concatenated directly into the backend SQL statement.\nUpon transmission, the database interprets the malicious input as part of the command structure rather than literal data. For example, by providing input such as '1 OR 1=1', an attacker may bypass conditional filters or retrieve administrative data that they are not authorized to access. The vulnerability is highly exploitable as it occurs in an 'admin' directory file, suggesting that an attacker could potentially gain unauthorized influence over administrative actions within the application.\nFrom a technical perspective, this is a classic SQL Injection vulnerability that occurs due to insecure coding practices where user-supplied input is trusted implicitly. Because this system is remote-accessible, an attacker can automate the exploitation process to perform blind SQL injection or error-based SQL injection to enumerate table names, schema information, and extract data from the application database. The post-exploitation impact includes the loss of confidentiality, integrity, and availability of the system's data, as the attacker effectively operates with the privileges of the database service user."
}