Reviewer Management System CVE-2026-105247

Exploitation requires network access to a deployed instance of SourceCodester Online Reviewer Management System 1.0 with the endpoint /reviewer_0/admins/assessments/Subject/btn_functions.php reachable, and the attacker must supply a manipulated value in the 'Subject' GET parameter with action=course. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed against a default deployment, and no non-default configuration is indicated. The primary limiting factor is exposure: this is a niche application rarely internet-facing in production, so realistic risk hinges on the instance being publicly accessible.

This is a moderate-severity SQL injection (CWE-89) whose signals are internally consistent but point to limited real-world urgency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation, which raises accessibility, but the impact metrics are all Low (VC:L/VI:L/VA:L, no subsequent-system impact), yielding a mid-range 6.9 base score rather than a critical one. Publicly available exploit code exists (referenced GitHub issue) and the CVSS carries E:P (Proof-of-Concept exploit maturity), so weaponization potential is real; however, there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation. The reporting source is VulDB, a vulnerability database that catalogs large numbers of small-vendor PHP flaws, and no independent vendor advisory or patch is referenced. Net assessment: this is a genuine but low-priority issue - the unauthenticated network reach makes it trivially testable, yet the niche product footprint and modest impact mean it is far less pressing than a high-CVSS flaw in widely deployed software. Missing data to note: no EPSS probability was supplied, and no patched version or vendor fix was identified.

A remote, unauthenticated attacker sends a crafted request to /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course with a malicious value injected into the 'Subject' parameter, breaking out of the SQL query to read or alter database contents. Publicly disclosed proof-of-concept exploit code exists (GitHub), lowering the barrier to reproduction. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is needed.