Online Reviewer Management System EUVD-2026-92178

Exploitation requires network reachability to the specific endpoint /reviewer_0/admins/assessments/activities/btn_functions.php with action=update, and injection is performed through the Title request argument - this exact feature (the assessment activities update function) must be present and reachable. The CVSS vector claims no authentication (PR:N) and no user interaction (UI:N), but the '/admins/' path strongly implies the function normally sits behind an administrative login; if that login is enforced, an attacker would need authenticated admin access, which would substantially limit real-world exploitability. Limiting factors: only SourceCodester Online Reviewer Management System 1.0 is affected, a niche product, and successful attacks depend on whether the admin area is exposed and whether authentication actually gates this endpoint.

This is a low-to-moderate real-world priority despite a public exploit. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation, and the vendor-assigned score of 6.9 (MEDIUM) reflects only Low impact to confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change. Publicly available exploit code exists (GitHub issue referenced, VulDB-tracked), and the CVSS 4.0 threat metric E:P (Proof-of-Concept) corroborates that an exploit is public but not yet reported as actively used. CONFLICTING SIGNAL: the vulnerable endpoint path is /reviewer_0/admins/assessments/... which implies an administrative console typically behind authentication, yet the CVSS vector asserts PR:N (unauthenticated) - verify whether the admin area enforces authentication, because this materially changes risk. No EPSS score and no CISA KEV listing were provided, which, combined with the product's obscurity, strongly suggests opportunistic/scanner-driven rather than widespread targeted exploitation. Net: a genuine but low-footprint SQL injection; prioritize only if this specific SourceCodester application is confirmed deployed and internet-exposed.

A remote attacker sends a crafted request to /reviewer_0/admins/assessments/activities/btn_functions.php?action=update with a malicious payload in the Title argument, injecting SQL that the backend executes against the database. Public exploit code exists, lowering the skill barrier, allowing the attacker to read or tamper with assessment/review records. Given the low CVSS attack complexity (AC:L), exploitation requires only a single crafted HTTP request if the admin endpoint is reachable.