Online Reviewer Management CVE-2026-93959

Requires the ability to send a request to /reviewer_0/admins/assessments/course/btn_functions.php with a manipulated 'Course' parameter. The administrative path strongly suggests the endpoint is intended to be reached only by an authenticated admin, which would limit exploitation to authenticated users unless the app fails to enforce access control on this handler (a common SourceCodester weakness) - this prerequisite is unverified. No user interaction is needed, and a public POC reduces the effort required. Limiting factors: niche educational product with negligible internet-facing deployment, single affected version (1.0), and unconfirmed authentication requirement.

This is a classic high-volume VulDB-style disclosure whose real-world priority is LOW despite the 6.9 'medium' CVSS 4.0 score. The vendor vector (CVSS:4.0/AV:N/AC:L/PR:N/UI:N/VC:L/VI:L/VA:L, E:P) claims unauthenticated remote SQL injection, and a public POC exists (GitHub issue zliang512/cve/issues/1), which normally elevates urgency. However, two signals cut hard against prioritization. First, the affected file lives under an administrative path (/reviewer_0/admins/assessments/course/btn_functions.php), which strongly implies the endpoint is normally reached only after admin login - contradicting the PR:N in the vendor vector; SourceCodester apps do have a track record of weak or bypassable auth, so this cannot be resolved without code review. Second, the vendor scored a SQL injection as VC:L/VI:L/VA:L, which understates the classic impact of SQLi (full database read = C:H) - the metrics are internally inconsistent. No EPSS score and no CISA KEV listing are available, and the product itself is a free educational PHP CRUD application with negligible production deployment. Net: publicly available exploit code exists, but this is a low-real-risk issue driven by product obscurity and disputed prerequisites rather than a genuine widespread threat.

An attacker reaches the course assessment btn_functions.php endpoint and submits a crafted value in the 'Course' parameter that breaks out of the SQL query, allowing the backend database to be enumerated or dumped (usernames, password hashes, assessment data). A public proof-of-concept is available on GitHub, lowering the skill barrier, though whether prior admin authentication is required is not confirmed from the available data.