Online Reviewer Management EUVD-2026-83716

Exploitation targets the ID argument of /reviewer_0/admins/assessments/databank/btn_functions.php when action=remove; a manipulated ID value is injected into the backend SQL query. Limiting factor: the endpoint resides under the application's /admins/ management area, which in typical SourceCodester deployments requires a valid administrator session, so realistic exploitation likely requires authenticated access despite the vendor's PR:N rating - this should be verified against the actual access control on that script. No user interaction is required, and the request is a simple remote HTTP GET, making it trivial to automate once the endpoint is reachable.

The primary quantitative signal is the vendor (VulDB) CVSS 4.0 base score of 5.5 (VC:L/VI:L/VA:L) with an SSVC/temporal indicator of E:P (Proof-of-Concept exploit exists), and a published PoC is confirmed via a GitHub issue - so exploitation status is 'publicly available exploit code exists,' distinct from confirmed active exploitation. No EPSS score and no CISA KEV listing are present in the input, so there is no evidence of widespread or active exploitation; this reads as a routine, PoC-backed SQL injection rather than an urgent priority. Two signals conflict and should be treated cautiously: (1) the vendor rates PR:N (unauthenticated), yet the affected path (/reviewer_0/admins/assessments/databank/btn_functions.php) sits under an /admins/ management area, which typically requires an authenticated admin session - verify whether this endpoint is truly reachable pre-auth. (2) The vendor caps confidentiality at VC:L, but a classic ID-parameter SQLi generally allows full database extraction, arguing for higher confidentiality impact. The CWE is also generic (CWE-74 injection parent) where CWE-89 (SQL injection) is the precise classification. Net: moderate, opportunistic risk against a niche product, not a high-priority threat despite a public PoC.

An attacker reaches the databank remove endpoint and supplies a crafted value in the ID parameter (e.g., /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove&ID=<injection>), causing the unsanitized value to be concatenated into a SQL statement. Using UNION-based or blind techniques, the attacker extracts credentials and stored data or tampers with records. A public proof-of-concept exists (GitHub orzl1/cve issue #3), lowering the skill barrier; low attack complexity (AC:L) makes the request trivial to reproduce.