EUVD-2026-91164
GHSA-m6q3-w82g-46vw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach admin activity endpoint
-
ExploitInject SQL via Title parameter
-
ExecutionBackend executes malicious query
-
ImpactExtract or alter reviewer/assessment data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the 'Title' argument of /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity in Online Reviewer Management System 1.0. The '/admins/' path indicates the endpoint belongs to the administrative module, so a valid admin session is most likely required in practice even though the supplied CVSS marks PR:N - this authentication requirement is the primary limiting factor and should be confirmed against the source. Beyond that, the product must be deployed and the specific activity endpoint reachable; no user interaction or special non-default configuration is otherwise indicated. |
| Impact | This is a textbook low-priority finding despite a 'medium' headline score. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with E:P (Proof-of-Concept) yields 6.9 and indicates remote, low-complexity, unauthenticated access, but the vulnerable endpoint path (/reviewer_0/admins/assessments/...) strongly implies an administrative context, so the PR:N rating conflicts with the apparent need for admin access - verify with the actual code before treating this as fully unauthenticated. Impact is rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), consistent with VulDB's conservative scoring of SQL injection in small PHP apps. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or at-scale exploitation; the only exploitation signal is a public PoC (GitHub issue) reported by VulDB. Net: real but low urgency - a publicly-documented SQLi in an obscure, non-enterprise PHP application, not a widespread threat. Prioritize only if this specific product is actually deployed and internet-facing. |
| Exploit ScenarioDerived | A remote attacker submits a crafted value in the 'Title' parameter to btn_functions.php?action=activity, injecting SQL that the backend executes against the database. Publicly available exploit code (referenced via VulDB/GitHub) demonstrates the injection, lowering the skill barrier. If the admin endpoint requires a session, the attacker would first need valid or compromised admin access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows a remote attacker, likely with a valid administrative session, to manipulate the Title parameter of /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity and alter backend SQL queries, exposing or modifying limited application data. Publicly available exploit code exists, but CISA KEV does not list this as actively exploited, and the assessed CVSS 3.1 vector is PR:L, so successful exploitation is gated by access to the administrative module. This is a low-priority finding despite the medium headline score because the vulnerable endpoint is inside the admin path and the assessed impact is limited to low confidentiality, integrity, and availability effects.
RemediationAI
No vendor-released patch was identified in the provided intelligence, so remediation must rely on compensating controls until SourceCodester publishes an update. Restrict access to /reviewer_0/admins/ and especially the assessments/activities endpoint to trusted administrator IP addresses or VPN-only access, understanding that this limits legitimate admin convenience. Require strong authentication and session protections for the admin module, since the assessed prerequisite is a valid admin session. Review and refactor btn_functions.php to use parameterized SQL queries or prepared statements for the Title argument, and validate or allow-list expected Title values; this removes the injection root cause but requires code changes. If the activity feature is not needed, disable or remove the endpoint, accepting loss of that functionality. Deploy a WAF rule targeting SQLi patterns on the Title parameter as a temporary layer, noting false positives and bypass risk. Run the application's database account with least privilege to limit read/write impact, and monitor web and database logs for anomalous Title parameters or SQL errors. Relevant advisory references: https://vuldb.com/vuln/412765, https://vuldb.com/cve/CVE-2026-104123, and https://github.com/lemssh77/cve/issues/1.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is CWE-89 SQL injection in a PHP-based application, SourceCodester Online Reviewer Management System. The affected CPE is cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*, meaning the provided intelligence does not constrain the affected version beyond the product name and the description reference to version 1.0. The vulnerable functionality is the activity action in /reviewer_0/admins/assessments/activities/btn_functions.php, where the Title argument is passed into a SQL query without adequate neutralization. An attacker who can reach this endpoint and supply crafted Title input may read or modify database contents within the privileges of the application's database account. The assessed CVSS 3.1 vector (PR:L) and the /admins/ path indicate an administrative session is the practical prerequisite; the supplied CVSS 4.0 vector marks PR:N, so the authentication requirement should be confirmed against the source. Tags include PHP, SQLi, and Online Reviewer Management System.
Know when Online Reviewer Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable low-complexity SQLi, but the /admins/ endpoint implies a required low-privilege session so PR:L rather than PR:N; impacts rated Low per conservative SQLi scoring.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation of the argument Title results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
A vulnerability classified as critical has been found in SourceCodester Online Reviewer Management System 1.0. Rated cri
An issue was discovered in Online Reviewer Management System v1.0. Rated high severity (CVSS 7.2), this vulnerability is
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows attackers to manipulate the test_id paramet
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets an attacker who can reach the administrative
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to alter SQL queries throu
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows an attacker to manipulate the SQL statement
SQL injection in the test_id parameter of exam-delete.php in SourceCodester Online Reviewer Management System 1.0 allows
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate the ID param
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets unauthenticated remote attackers execute arbi
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers manipulate the Title argumen
Exploit-DB