Online Reviewer Management System CVE-2026-93973

Requires reaching /reviewer_0/admins/assessments/subject/btn_functions.php with action=remove and a manipulable ID parameter on a SourceCodester Online Reviewer Management System 1.0 install. The vulnerable file resides under the administrative /admins/ path, which normally implies an authenticated admin session; however the vendor rates PR:N, so exploitation may be possible without authentication if the admin area lacks access control (common in SourceCodester apps) - this is the key limiting factor to verify. No user interaction is needed and the attack is remote. A public POC lowers the skill barrier.

This is a classic low-real-priority SQL injection despite a mid-range CVSS. The vendor CVSS 4.0 vector (6.9, AV:N/AC:L/PR:N/UI:N/VC:L/VI:L/VA:L, E:P) claims unauthenticated network exploitation, and a public POC exists (GitHub orzl1/cve issue #2), so exploitability is real. However, two signals temper the priority: (1) prevalence is very low - SourceCodester Online Reviewer Management System is a hobbyist PHP tutorial project with negligible production footprint, and (2) the E:P (proof-of-concept) exploit-maturity, absence of EPSS/KEV data, and VulDB-only sourcing indicate this is a scanner/CVE-mill disclosure rather than a targeted campaign. There is a data conflict on privileges: the vulnerable file lives under /reviewer_0/admins/ (an administrative path implying authentication), yet the vendor rates PR:N - verify auth requirement with the vendor, as SourceCodester admin panels frequently ship with broken/absent access control. I also dispute the impact rating: a raw SQL injection into a DELETE action typically yields full database read/write, so VC:L understates it (I assess VC:H/VI:H). Net: publicly exploitable and technically real, but low operational urgency given the obscure, tiny-footprint product.

A remote attacker sends a crafted request to /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove with a malicious ID parameter, injecting SQL into the delete query. Because a public POC already exists, an attacker can copy it to dump credentials/assessment data or tamper with records with minimal effort. If the admin endpoint is genuinely reachable without authentication (as the vendor's PR:N implies), this is a direct unauthenticated database compromise; if not, it requires an authenticated admin session.