Online Reviewer System CVE-2026-108948

Exploitation requires an authenticated low-privilege account on the target (CVSS PR:L) that can reach the User Profile Update Handler endpoint /reviewer/system/system/admins/manage/users/btn_functions.php; the attacker then supplies an attacker-chosen usertype_id parameter that the update handler assigns to the user object without validation (CWE-915 dynamically-determined object attributes), elevating their privilege level. No user interaction and no special non-default configuration are required (AT:N/UI:N), but the need for a valid pre-existing account and network reachability to the admin/manage path are the primary limiting factors; impact is confined to integrity and availability (VC:N).

Signals point to a low-to-moderate, low-priority issue despite a functioning public exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring an already-authenticated low-privilege account (PR:L), with only partial integrity and availability impact and no confidentiality impact (VC:N/VI:L/VA:L), yielding a medium 5.3 base score. The E:P temporal metric and the named GitHub repository confirm proof-of-concept exploit code exists, but there is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active or widespread exploitation - consistent with a research-grade disclosure (VulDB) against a hobby/educational product rather than a targeted enterprise campaign. One notable conflict: the CWE-915 mapping and the exploit repository title ('Privilege-Escalation') indicate a mass-assignment privilege-escalation flaw (manipulating usertype_id to elevate account type), which is an integrity problem, yet the input Tags label it 'Information Disclosure' and VC:N explicitly rules out confidentiality loss - the tag appears mislabeled; treat this as privilege escalation, not info disclosure. Overall this is a high-CVSS-appearing-but-low-real-risk item given the obscure product and authentication requirement.

An attacker who already holds a valid low-privilege account on an exposed Online Reviewer System instance submits a crafted profile-update request to /reviewer/system/system/admins/manage/users/btn_functions.php, injecting an unexpected usertype_id value that the handler blindly binds to the user object, elevating their account to a higher-privilege (e.g. admin) type. A public proof-of-concept exploit for this privilege escalation is available on GitHub, lowering the skill needed to reproduce it. Exploitation is remote but gated by the need for prior authentication.