Description

A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-20T09:16:39.693Z",
  "pubdate": "2026-09-20T09:16:39.693Z",
  "executiveSummary": "The Online Reviewer Management System 1.0 contains a critical SQL injection vulnerability within the /reviewer_0/admins/assessments/databank/btn_functions.php script.\nThe vulnerability arises from improper neutralization of user-supplied data passed via the 'ID' parameter during administrative 'remove' operations.\nAn unauthenticated or authenticated remote attacker can exploit this flaw to manipulate backend database queries, potentially leading to unauthorized data exposure, modification, or complete database compromise.\nThis vulnerability is categorized as a high-risk flaw due to the potential for full administrative takeover of the backend database. The availability of public exploit code increases the likelihood of active exploitation, necessitating immediate defensive measures to secure the database layer.\nThe flaw allows an attacker to inject arbitrary SQL commands, bypassing application-level access controls and impacting the integrity and confidentiality of the management system's data.",
  "technicalDetails": "The vulnerability resides in the server-side processing of the /reviewer_0/admins/assessments/databank/btn_functions.php file, specifically targeting the 'action=remove' request parameter.\nRoot Cause: The application fails to implement adequate input validation or parameterized queries (prepared statements) when handling the 'ID' parameter. This allows user-controlled input to be concatenated directly into the SQL execution string, enabling an attacker to break the syntax of the intended query and append malicious SQL directives.\nExploitation Method: An attacker can send a crafted HTTP request to the vulnerable endpoint, manipulating the 'ID' argument to terminate the legitimate SQL statement and inject arbitrary malicious commands. For example, by injecting crafted SQL syntax (e.g., UNION SELECT statements, boolean-based inference, or time-based blind injection techniques), an attacker can extract sensitive information from the application's backend database.\nAttack Flow: 1. The attacker identifies the target endpoint /reviewer_0/admins/assessments/databank/btn_functions.php. 2. The attacker crafts a request using the 'ID' parameter, incorporating malicious SQL payloads. 3. The server-side script receives the malicious input without sufficient sanitization. 4. The database engine executes the altered query, which may reveal database structure, user credentials, or administrative session tokens.\nImpact: Successful exploitation allows for unauthorized retrieval, modification, or deletion of data stored in the database. In many configurations, this could escalate to an administrative bypass or the extraction of the entire database contents. Given the nature of the application as a management system, this could lead to the exposure of personal identifiable information (PII) or assessment records. The lack of input validation ensures that the query logic is entirely determined by the user input rather than the developer's intended schema."
}