SourceCodester Online Reviewer Management System SQLi

SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate the 'ID' request parameter of /reviewer_0/admins/assessments/examproper/questions-view.php, altering backend database queries with partial confidentiality, integrity and availability impact (CVSS 5.5; vendor-disclosed, VulDB-tracked). Publicly available exploit code exists - a proof-of-concept is published at https://github.com/Aszadom/cve/issues/1 - but there is no confirmed active exploitation (CISA KEV). The CVSS 4.0 vector records PR:N/UI:N (no authentication or user interaction required), although the '/admins/' segment of the vulnerable path suggests the questions-view function is part of the administrative interface and may in practice require an authenticated admin session, which would materially limit realistic exploitation. No vendor-released patch was identified at time of analysis.

SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the access_code parameter in /reviewer_0/admins/assessments/examproper/btn_functions.php. Per the CVSS vector, no authentication or user interaction is required, though the endpoint's location under an 'admins/' directory suggests it may be intended for authenticated administrators; a public exploit exists. No vendor-released patch has been identified at time of analysis, but the product is a niche educational PHP application with minimal enterprise deployment, so real-world risk is limited.