Online Reviewer Management System CVE-2026-95926

Requires network access to the SourceCodester Online Reviewer Management System 1.0 admin endpoint /reviewer_0/admins/assessments/pretest/btn_functions.php with action=update, supplying a malicious test_id parameter. The '/admins/' path segment indicates this is administrative functionality, so exploitation most likely requires an authenticated admin session despite the vendor's PR:N rating - defenders should treat authentication and reachability of the admin area as the primary limiting factors. No user interaction is required, and the flaw affects the single known version (1.0) with no patched release available.

This is a CWE-89 SQL injection in SourceCodester Online Reviewer Management System 1.0 via the test_id parameter of /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update. The vendor (VulDB) CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L (6.9, Medium) with E:P indicates a network-reachable, low-complexity flaw with a proof-of-concept. Publicly available exploit code exists (GitHub issue by huliangjia). There is no EPSS score and no CISA KEV listing in the provided data, so there is no evidence of widespread or active exploitation - the signals point to a POC-only, low-real-world-priority issue typical of obscure PHP CMS submissions. Two data conflicts should be verified: (1) the endpoint path segment '/admins/' strongly implies an administrative, authenticated context, yet the vector claims PR:N (unauthenticated) - verify whether the admin panel requires login; and (2) VulDB rates all three impacts as Low (VC:L/VI:L/VA:L), but classic SQL injection typically enables full database read/write, so real confidentiality impact may be understated. Overall real-world risk is low: the affected product is a niche, non-enterprise application with negligible deployment footprint.

An attacker reaches the pretest assessment admin endpoint and submits a crafted test_id value to the action=update handler, injecting SQL that the application concatenates into a query. A publicly disclosed proof-of-concept exists, so exploitation is straightforward and, given AC:L, requires no special timing or conditions. Depending on the actual authentication model, this yields unauthorized read or modification of the backend database.