Online Reviewer System CVE-2026-108956

Exploitation requires network access to a deployed Online Reviewer System 1.0 instance where the admin user-management endpoint /reviewer/system/system/admins/manage/users/btn_functions.php (User Update Handler) is reachable. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special configuration are needed - the injectable parameter is exploitable against a default install. The principal limiting factor is exposure: the target is a niche educational PHP application that must be installed and internet-reachable, and exploitation presumes the vulnerable btn_functions.php handler is accessible without a session, as indicated by both the vector and the public PoC.

This is a CWE-89 SQL injection in code-projects Online Reviewer System 1.0, reachable remotely via the User Update Handler at /reviewer/system/system/admins/manage/users/btn_functions.php. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, with all three impact dimensions rated Low (VC:L/VI:L/VA:L) and no scope change (SC:N/SI:N/SA:N), yielding a base score of 5.5 (Medium). The E:P (Proof-of-Concept) exploit-maturity value is consistent with the input signal that a public exploit exists, and the exploit is hosted on GitHub ('Unauthenticated-SQL-Injection-in-Online-Reviewer-System'), so publicly available exploit code exists but there is no public exploit identified as actively exploited - the CVE is NOT on CISA KEV. No EPSS score was provided in the input, so real-world exploitation probability cannot be quantified here. The signals are internally consistent (unauthenticated network SQLi with a public PoC), so the chief risk driver is the trivial access barrier (PR:N, AC:L) rather than impact magnitude. The honest counterweight is footprint: this is an entry-level/educational PHP project from code-projects.org, not enterprise software, so despite easy exploitability the real-world priority is low-to-moderate. One caveat: the vendor-assigned impact is rated only Low across C/I/A, which is conservative for an unauthenticated SQL injection - a typical SQLi of this kind can enable full database read (including admin credentials), so the confidentiality impact may be understated; verify against the PoC behavior.

A remote, unauthenticated attacker sends a crafted HTTP request to the User Update Handler endpoint (btn_functions.php), injecting malicious SQL into a parameter that is concatenated into a database query. Because a public proof-of-concept exists on GitHub and no authentication or user interaction is required (PR:N/UI:N), the attacker can extract or manipulate database contents - for example dumping stored user records or admin credentials. Low attack complexity (AC:L) means the attack is reliably repeatable against any exposed instance.