Online Reviewer Management System EUVD-2026-92266

Exploitation requires HTTP access to the 'update' action of the administrative assessment handler at /reviewer_0/admins/assessments/Subject/btn_functions.php, supplying attacker-controlled input in the 'Subject' parameter. The supplied CVSS vector states PR:N (no authentication), but the '/admins/' path strongly implies an authenticated admin/reviewer session is normally required to reach this endpoint - this is the key limiting factor and should be confirmed against the deployed application's access controls. No special non-default configuration is indicated, and no user interaction is needed. The overarching practical limiter is deployment scarcity: the affected product is rarely run in production.

This is a textbook low-to-moderate real-world risk despite the medium CVSS 4.0 score of 6.9. Signals cross-referenced: the provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with E:P indicates a network-reachable, low-complexity injection with proof-of-concept exploit maturity, and the vendor-rated impacts are uniformly LOW (VC:L/VI:L/VA:L) rather than the HIGH values typical of unconstrained SQLi - suggesting limited data exposure or a constrained injection context. No EPSS score was provided, and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation; publicly available exploit code exists (GitHub PoC) but PoC availability must not be conflated with in-the-wild use. A notable conflict: the CVSS vector asserts PR:N (unauthenticated) yet the vulnerable endpoint path is '/reviewer_0/admins/assessments/Subject/btn_functions.php', an administrative function that in most SourceCodester applications sits behind a login - verify whether authentication is actually required before trusting the unauthenticated rating. The single most important mitigating factor is prevalence: SourceCodester Online Reviewer Management System is a small PHP demo/tutorial application with negligible production footprint, so even a trivially exploitable flaw affects very few real environments. Net assessment: low operational priority for most organizations unless this specific application is confirmed deployed and internet-facing.

A remote attacker sends a crafted request to /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update with a malicious payload in the 'Subject' parameter, injecting SQL into the backend query. A public proof-of-concept exists (GitHub), lowering the skill barrier; given AC:L the attack is reliable, though if the admin endpoint enforces a session the attacker must first obtain valid credentials or an active session.