SourceCodester Online Reviewer Management System SQLi/Injection Flaws

SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through the difficulty_id parameter on the /reviewer_0/admins/assessments/databank/btn_functions.php endpoint when action=add, allowing partial read, modification, and disruption of the underlying database. The vendor-supplied CVSS 4.0 score is 6.9 with a vector claiming no privileges or user interaction required (PR:N/UI:N), but the vulnerable path sits inside the /admins/ administrative area, which in typical deployments is only reachable behind an authenticated administrator session - an independent assessment re-rates it as CVSS 3.1 AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity, and availability impact. Publicly available exploit code exists and has been published alongside the disclosure, and there is no indication of confirmed active exploitation (no CISA KEV listing), while exploitation is further constrained by how few instances of this obscure PHP application are deployed and internet-reachable.

SQL injection in SourceCodester Online Reviewer Management System 1.0 lets an attacker who can reach the administrative assessment endpoint inject arbitrary SQL through the test_id parameter of /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update, exposing and potentially altering stored review and assessment data. Publicly available exploit code exists (a proof-of-concept is published in the GitHub issue referenced by VulDB), and the vendor has not shipped a fixed version. Because the vulnerable path sits under /admins/, exploitation in practice most likely requires a valid administrative session, making reachability of the admin area and credential strength the primary limiting factors; the CVSS 4.0 score of 6.9 treats it as PR:N, our own assessment rates it CVSS:3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality and low integrity impact.

SQL injection in SourceCodester Online Reviewer Management System 1.0 allows attackers to manipulate the test_id parameter in /reviewer_0/admins/assessments/pretest/exam-delete.php, potentially reading or altering database contents. Publicly available exploit code exists, but practical exploitation requires reaching the administrative interface and likely a valid admin session despite the CVSS 4.0 vector indicating no privileges; the product's rare deployment footprint further limits real-world risk. This is a classic high-nominal/low-real-risk finding with limited confidentiality, integrity, and availability impact.

SQL injection in SourceCodester Online Reviewer Management System 1.0 lets a remote attacker supply crafted input in the difficulty_id argument of /reviewer_0/admins/assessments/databank/btn_functions.php?action=update and have it executed as part of the backend SQL query, exposing or altering assessment and reviewer data. The disclosure is rated 5.5 (CVSS 4.0) with only low-level confidentiality, integrity and availability impact, and publicly available exploit code exists via the linked GitHub issue; there is no CISA KEV entry confirming active exploitation. Authentication requirements are not confirmed from available data: the CNA vector records PR:N (unauthenticated) while our independent assessment scores PR:L (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) because the vulnerable endpoint sits under an /admins/ administrative path, which strongly suggests a valid session is normally needed, and this discrepancy is the main factor governing real-world exploitability.