EUVD-2026-84994
GHSA-c536-fhhh-723h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach admin databank endpoint over network
-
ExploitInject SQL via difficulty_id parameter
-
ExecutionBackend executes tainted query
-
ImpactRead or alter assessment/reviewer records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to reach the endpoint /reviewer_0/admins/assessments/databank/btn_functions.php with action=add and supply a manipulated difficulty_id parameter against SourceCodester Online Reviewer Management System 1.0. The CVSS vector states no privileges or user interaction (PR:N/UI:N), but the URL resides in the administrative (/admins/) section, which in typical deployments requires an authenticated admin session - a likely limiting factor not reflected in the vendor CVSS. Exploitation is further limited to instances of this obscure application actually deployed and internet-reachable. |
| Impact | This is a CWE-89 SQL injection in a SourceCodester Online Reviewer Management System 1.0 endpoint (databank/btn_functions.php, action=add, difficulty_id parameter). Exploitation status: publicly available exploit code exists (VulDB-referenced GitHub issue at huliangjia/cve), but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. The vendor (VulDB) CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:L/VA:L yields 6.9 (Medium) and includes E:P (proof-of-concept exploit maturity), consistent with the disclosed POC. A notable tension exists: the CVSS marks the flaw unauthenticated (PR:N), yet the vulnerable path is under /reviewer_0/admins/ - an administrative area that in most SourceCodester apps requires a login - so the real-world attack surface may be authenticated rather than fully unauthenticated; verify with the POC/vendor. Overall this is a low-priority, low-prevalence issue: a self-diagnosed VulDB entry for niche hobby/student PHP software with a POC but no KEV, no EPSS, and only partial (Low) impact ratings rather than full database compromise. |
| Exploit ScenarioDerived | A remote attacker sends a crafted HTTP request to /reviewer_0/admins/assessments/databank/btn_functions.php?action=add with a malicious difficulty_id value, injecting SQL into the backend query. A public POC exists (linked via VulDB), so exploitation is turnkey; per CVSS the attack is network-based with low complexity, though the /admins/ path may require a valid admin session in practice. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through the difficulty_id parameter on the /reviewer_0/admins/assessments/databank/btn_functions.php endpoint when action=add, allowing partial read, modification, and disruption of the underlying database. The vendor-supplied CVSS 4.0 score is 6.9 with a vector claiming no privileges or user interaction required (PR:N/UI:N), but the vulnerable path sits inside the /admins/ administrative area, which in typical deployments is only reachable behind an authenticated administrator session - an independent assessment re-rates it as CVSS 3.1 AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity, and availability impact. Publicly available exploit code exists and has been published alongside the disclosure, and there is no indication of confirmed active exploitation (no CISA KEV listing), while exploitation is further constrained by how few instances of this obscure PHP application are deployed and internet-reachable.
RemediationAI
No vendor-released patch has been identified at time of analysis, so affected operators must either remove or isolate the product or apply compensating controls. Immediate mitigation: restrict network access to the /reviewer_0/admins/ path tree so only trusted management networks or VPN clients can reach it, accepting that this blocks legitimate remote administrators and does not fix the underlying injection; enforce authentication and role checks on btn_functions.php server-side if the deployment currently relies on client-side or absent authorization; validate and cast difficulty_id strictly as an integer (or replace the raw query with a parameterized prepared statement) inside btn_functions.php, which stops the injection class outright at the cost of a small code change and regression testing of the assessment add flow; if the databank assessment module is not used, disable or delete the databank directory, which removes the attack surface entirely but may break related reviewer workflows; and deploy a WAF rule targeting SQLi patterns on difficulty_id, noting that signature-based filtering is bypassable with obfuscated payloads and should not be the sole control. Given SourceCodester's history of unmaintained sample applications, migration to a supported platform or removal of the internet-facing deployment should be considered the durable fix. Monitor the referenced VulDB entry (https://vuldb.com/vuln/408546) and the public exploit thread (https://github.com/huliangjia/cve/issues/4) for any vendor update, and treat the endpoint as actively attackable while exploit code is public.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in a PHP web application. The affected file, /reviewer_0/admins/assessments/databank/btn_functions.php, handles assessment databank operations and, for action=add, consumes a user-supplied difficulty_id argument that is passed into a database query without proper parameterization or sanitization, letting crafted input alter the SQL statement's logic. The CPE cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:* confirms the impacted product and indicates a wildcard version match, i.e. no fixed version is enumerated. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) describes a network-reachable, low-complexity, no-preconditions issue with limited CIA impact and a proof-of-concept exploit maturity (E:P) - matching the reported public disclosure. The independent assessment's CVSS 3.1 vector disagrees on privilege requirements (PR:L rather than PR:N), because the administrative directory prefix implies an admin session in normal deployments; the same low confidentiality, integrity, and availability impacts are retained.
Know when Online Reviewer Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
SQLi in an /admins/ endpoint most likely needs an authenticated session (PR:L); low complexity network vector with partial C/I/A impact consistent with a targeted injection point.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. The manipulation of the argument difficulty_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in SourceCodester Online Reviewer Management System SQLi/Injection Flaws
View all 4A vulnerability classified as critical has been found in SourceCodester Online Reviewer Management System 1.0. Rated cri
An issue was discovered in Online Reviewer Management System v1.0. Rated high severity (CVSS 7.2), this vulnerability is
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to alter SQL queries throu
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows a remote attacker, likely with a valid admi
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows an attacker to manipulate the SQL statement
SQL injection in the test_id parameter of exam-delete.php in SourceCodester Online Reviewer Management System 1.0 allows
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate the ID param
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets unauthenticated remote attackers execute arbi
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers manipulate the Title argumen
Exploit-DB