Online Reviewer Management System CVE-2026-102908

Exploitation targets the specific endpoint /reviewer_0/admins/assessments/examproper/questions-view.php via the 'ID' request parameter in SourceCodester Online Reviewer Management System 1.0. The CVSS 4.0 vector states PR:N/UI:N (no authentication or user interaction), but the '/admins/' segment of the path suggests the questions-view function is part of the administrative interface and may in practice require an authenticated admin session, which would significantly limit realistic exploitation. Limiting factors: the affected software is a niche, self-hosted PHP application with minimal deployment; only version 1.0 is named; and impact is limited (VC:L/VI:L/VA:L), indicating the injection yields partial rather than full database access.

This is a classic SourceCodester PHP application SQL injection with modest real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates unauthenticated remote exploitation at low complexity, which raises theoretical urgency, but all three impact metrics are only Low (VC:L/VI:L/VA:L), producing a 5.5 (Medium) score - consistent with a single injectable parameter rather than full database compromise. SSVC-relevant signals: exploit maturity is E:P (Proof-of-Concept), and a public exploit is confirmed (GitHub issue + VulDB entry), so 'publicly available exploit code exists.' No EPSS score and no CISA KEV listing were provided, and there is no evidence of active exploitation - the public POC is a distinct signal from in-the-wild use. The overall picture is a low-priority, low-footprint bug: real and remotely exploitable, but affecting an obscure academic/demo application, and the vendor (SourceCodester) is historically unresponsive to such reports. Note the PR:N claim rests on the description/vector alone; many SourceCodester admin-path files (this path contains '/admins/') are behind a login, so real-world exploitation may require authentication despite the PR:N metric - verify whether questions-view.php is reachable pre-auth.

A remote attacker sends a crafted HTTP request to /reviewer_0/admins/assessments/examproper/questions-view.php with a manipulated 'ID' parameter containing SQL syntax, causing the backend query to be altered. Because a public proof-of-concept is available (VulDB and a GitHub issue), an unskilled attacker can copy the payload to extract or tamper with limited database contents. The '/admins/' path suggests the endpoint may sit behind an admin login, which would constrain who can reach it.