Online Reviewer Management System CVE-2026-93972

Requires a reachable deployment of SourceCodester Online Reviewer Management System 1.0 with the /reviewer_0/admins/assessments/course/btn_functions.php endpoint accessible to the attacker. Exploitation targets the courseID parameter and needs no user interaction; the vendor vector asserts no authentication (PR:N), but because the file lives under an /admins/ directory, unauthenticated reachability depends on the app lacking a session/authorization guard on that path - a common but unverified trait of SourceCodester projects. No non-default configuration is otherwise required.

This is a classic high-CVSS-number-but-modest-real-risk issue. The vendor CVSS 4.0 base of 6.9 rests on unauthenticated network exploitation (AV:N/AC:L/PR:N/UI:N) but tempers all three impact metrics to Low (VC:L/VI:L/VA:L), and the vector explicitly carries E:P (Proof-of-Concept exploit maturity), consistent with the publicly disclosed POC on GitHub (orzl1/cve issue #1). No EPSS score, no CISA KEV listing, and no evidence of active exploitation are present in the data - exploitation status is 'publicly available exploit code exists,' which is a distinct and weaker signal than in-the-wild abuse. The SSVC-style read is: exploitation=PoC (public code, not observed active), technical impact partial. The impact rating is arguably understated for a SQL injection: successful injection typically enables full read of the backing database (admin credential hashes, user PII), so I would independently raise confidentiality toward High. The overwhelming risk-limiting factor is prevalence: SourceCodester's Online Reviewer Management System is a free hobbyist PHP tutorial project with no meaningful production footprint, so aggregate real-world exposure is minimal. The affected file path sits under /admins/, which conflicts with the vendor's PR:N (unauthenticated) claim - SourceCodester apps frequently omit auth guards on admin endpoints, but this should be verified against the source before relying on unauthenticated reachability.

A remote attacker sends an HTTP request to /reviewer_0/admins/assessments/course/btn_functions.php with a crafted courseID parameter carrying SQL metacharacters, which is concatenated into a backend query unsanitized. A public proof-of-concept exists (GitHub orzl1/cve issue #1), and because CVSS indicates low attack complexity and no privileges, an attacker can automate union/blind extraction of database contents including administrator credentials. The unauthenticated claim (PR:N) should be confirmed, since the endpoint resides under an /admins/ path.