EUVD-2026-84995
GHSA-mw32-86gq-66hm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach reviewer management web app
-
ExploitSend crafted difficulty_id to btn_functions.php update action
-
ExecutionInject SQL into backend query
-
ImpactRead or modify database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Requires the attacker to reach the Online Reviewer Management System web application and issue a request to /reviewer_0/admins/assessments/databank/btn_functions.php with action=update and a manipulated difficulty_id parameter. The CVSS vector states PR:N (unauthenticated), but the endpoint's location under an /admins/ administrative path strongly suggests an admin session is normally required - this is the key limiting factor and should be verified, as it would materially change real-world exploitability. No user interaction is needed and the attack is network-remote; a public POC exists, reducing exploitation effort. |
| Impact | This is a classic high-volume, low-priority VulDB disclosure. The vendor-assigned CVSS 4.0 base score is only 5.5 (MEDIUM), with a vector of AV:N/AC:L/AT:N/PR:N/UI:N and partial impact across all three dimensions (VC:L/VI:L/VA:L) - consistent with a single-parameter SQL injection rather than a full database takeover. The E:P (Proof-of-Concept) exploit-maturity metric matches the description's statement that a public exploit exists (GitHub issue). No EPSS score and no CISA KEV entry are provided, so there is no evidence of automated or widespread exploitation; this reads as an academically-disclosed flaw in a rarely-deployed application, not an active threat. One notable inconsistency: the vulnerable endpoint lives under /reviewer_0/admins/, implying an administrative panel that would normally require authentication, yet the CVSS vector asserts PR:N (unauthenticated) and the description gives no auth detail - this PR:N should be verified against the application's actual access control, as VulDB frequently scores such SourceCodester endpoints as unauthenticated without confirming the login gate. The CWE is tagged CWE-74 (generic injection) where CWE-89 (SQL injection) would be more precise. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request to /reviewer_0/admins/assessments/databank/btn_functions.php?action=update with a malicious difficulty_id value, injecting SQL into the backend query to read or tamper with database contents. A public proof-of-concept exists (referenced GitHub issue), lowering the skill barrier. Because the endpoint sits under an /admins/ path, real-world exploitation may require a valid admin session despite the vendor's PR:N rating. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets a remote attacker supply crafted input in the difficulty_id argument of /reviewer_0/admins/assessments/databank/btn_functions.php?action=update and have it executed as part of the backend SQL query, exposing or altering assessment and reviewer data. The disclosure is rated 5.5 (CVSS 4.0) with only low-level confidentiality, integrity and availability impact, and publicly available exploit code exists via the linked GitHub issue; there is no CISA KEV entry confirming active exploitation. Authentication requirements are not confirmed from available data: the CNA vector records PR:N (unauthenticated) while our independent assessment scores PR:L (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) because the vulnerable endpoint sits under an /admins/ administrative path, which strongly suggests a valid session is normally needed, and this discrepancy is the main factor governing real-world exploitability.
RemediationAI
No vendor-released patch was identified at time of analysis, and SourceCodester distributes this application as shared source code rather than through a formal vendor update channel, so remediation falls to the operator. The primary fix is to edit btn_functions.php and replace the string-concatenated query with a parameterized statement (PDO or mysqli prepared statements with a bound parameter), and to cast or strictly validate difficulty_id as an integer before use; the trade-off is that this requires a code change, a redeploy, and review of other databank actions that share the same query-building pattern, since fixing only one action leaves comparable injection points open. Interim compensating controls include restricting access to the /reviewer_0/admins/ path through web server ACLs, IP allowlisting, or HTTP authentication so only trusted administrative networks can reach it, at the cost of breaking remote admin access for legitimate users; deploying a WAF rule that rejects SQL metacharacters or non-integer values in the difficulty_id parameter, which is easy to bypass and can cause false positives on legitimate administrative traffic; and disabling the assessment databank update action entirely if it is not in active use. Because the flaw permits both reading and, to a limited degree, modification of database contents, operators who have exposed the endpoint should also review web server and database logs for anomalous requests to btn_functions.php?action=update and audit assessment records for unexpected changes. Vendor and advisory references for tracking are https://www.sourcecodester.com/, https://vuldb.com/vuln/408547, and https://github.com/huliangjia/cve/issues/5.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP web application (SourceCodester Online Reviewer Management System 1.0) whose administrative back end exposes procedural scripts under /reviewer_0/admins/assessments/databank/. The script btn_functions.php acts as an action dispatcher: the query string parameter action=update selects an update routine, and the difficulty_id argument is passed into that routine. Mapped to CWE-74 (improper neutralization of special elements used in an injection construct), the root cause is that difficulty_id is concatenated into a SQL statement rather than being bound as a parameter, so attacker-controlled characters change the structure of the query executed by the underlying database. This is the classic PHP/MySQL injection pattern seen in code-sharing/demo applications: no prepared statements, no type enforcement on the difficulty_id value, and no centralized input validation. The endpoint's placement beneath /admins/ indicates it is part of an authenticated administrative workflow, which is why our assessment diverges from the CNA vector on the privileges required. Public analysis and a proof-of-concept are referenced at the VulDB entry (vuldb.com/vuln/408547 and its CTI view, vuldb.com/cve/CVE-2026-95925) and in the reporter's GitHub issue (github.com/huliangjia/cve/issues/5); no CPE identifiers were supplied, so the affected scope is defined by the product name and version 1.0 rather than by a CPE string.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
SQLi via a single parameter on an /admins/ endpoint implies authenticated access (PR:L); partial C/I/A impact reflects limited single-query injection rather than full DB compromise.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=update. The manipulation of the argument difficulty_id results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in SourceCodester Online Reviewer Management System SQLi/Injection Flaws
View all 4In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB