SourceCodester Online Reviewer CVE-2026-102909

Exploitation requires reaching the specific endpoint /reviewer_0/admins/assessments/examproper/btn_functions.php on a deployed SourceCodester Online Reviewer Management System 1.0 instance and supplying a crafted access_code parameter. Per the supplied CVSS vector (PR:N/UI:N) no authentication or user interaction is nominally required; however, the endpoint's placement under an 'admins/' directory suggests it may be intended to sit behind an admin session, which - if enforced - would limit exploitation to authenticated users. The primary practical limiting factor is the product's rarity: it is educational/demo PHP software with essentially no enterprise deployment.

This is a classic low-severity SQL injection in a niche open-source PHP application. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N with VC:L/VI:L/VA:L) describes a network-reachable, low-complexity, unauthenticated flaw whose per-impact severity is only Low across confidentiality, integrity, and availability - hence the modest 5.5 score rather than the 7-9 range typical of authenticated-full-database SQLi. The E:P (Proof-of-Concept) exploit maturity is corroborated by the referenced public exploit on GitHub, so publicly available exploit code exists; however, there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation provided. The realistic priority is LOW: while the exploit is public and requires no authentication, the affected product (SourceCodester Online Reviewer Management System) has negligible real-world deployment, and the vendor's own scoring keeps impact at Low tier. Note a mild tension worth flagging: the vector rates PR:N (unauthenticated) yet the vulnerable file path (/reviewer_0/admins/assessments/...) sits under an 'admins' directory, implying the endpoint may be intended for administrative use - verify whether the endpoint is actually reachable without authentication, as this materially affects real risk.

A remote, unauthenticated attacker sends a crafted HTTP request to /reviewer_0/admins/assessments/examproper/btn_functions.php with a malicious payload in the access_code parameter, injecting SQL to extract or manipulate database contents. A public proof-of-concept exists on GitHub (Aszadom/cve issue #2), lowering the skill barrier. Because attack complexity is low and no user interaction is needed, the request can be automated, though impact is limited (Low C/I/A per the CVSS vector).