Online Reviewer Management System EUVD-2026-89604

Exploitation requires sending a request to the specific endpoint /reviewer_0/admins/assessments/examproper/exam-delete.php with a manipulated test_id parameter in SourceCodester Online Reviewer Management System 1.0. The primary limiting factor is that this endpoint sits under the /admins/ administrative directory, strongly implying a valid authenticated admin session is needed in practice, which contradicts the CVSS PR:N rating and should be confirmed. Exploitation is otherwise network-based and requires no user interaction; it is constrained to the single named product and version, which has a small real-world deployment footprint.

This is a CWE-89 SQL injection in the test_id parameter of exam-delete.php within SourceCodester Online Reviewer Management System 1.0, rated CVSS 4.0 6.9 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L and exploit maturity E:P (proof-of-concept). Publicly available exploit code exists (referenced GitHub issue at Aszadom/cve), which raises practical risk, but there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation - the E:P signal indicates only that PoC code is circulating, not weaponized mass exploitation. A key conflict exists between the CVSS vector and the description: the vulnerable file resides under /reviewer_0/admins/assessments/examproper/, an administrative path that in practice implies an authenticated admin session, yet the vector claims PR:N (unauthenticated); VulDB routinely scores such SourceCodester admin-area flaws as PR:N, so the true privilege requirement should be verified. The low impact metrics (VC:L/VI:L/VA:L) are conservative - SQL injection commonly permits full database read and often write, so real impact could exceed the assigned Low ratings. Overall this is a medium-priority issue: a real, publicly-documented SQLi against a niche product, not a high-urgency internet-scale threat.

An attacker sends a crafted HTTP request to /reviewer_0/admins/assessments/examproper/exam-delete.php with a malicious test_id value containing SQL syntax, causing the backend query to be manipulated and enabling database extraction or tampering. Public proof-of-concept exploit code is already released (referenced GitHub issue), lowering the skill barrier. Because the endpoint lives in the admin area, exploitation most realistically requires an authenticated administrator session despite the CVSS PR:N rating.