Description
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation of the argument Title results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Published: 2026-10-02
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability is found in the btn_functions.php component of the SourceCodester Online Reviewer Management System. An attacker can manipulate the Title argument of the activity action to inject arbitrary SQL commands. This injection allows unauthorized reading, modification, or deletion of database records, potentially compromising the confidentiality, integrity, and availability of the system.

Affected Systems

The affected product is SourceCodester Online Reviewer Management System version 1.0. The vulnerability resides in the file /reviewer_0/admins/assessments/activities/btn_functions.php and is triggered through the activity action interface.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. Although the EPSS score is not available, the vulnerability is publicly exploitable and can be launched remotely. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw by sending a crafted Title parameter in a request to the activity action endpoint, potentially bypassing authentication or other checks if the system does not enforce proper access controls.

Generated by OpenCVE AI on October 2, 2026 at 04:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SourceCodester Online Reviewer Management System to the latest version or apply the vendor’s patch if available.
  • Implement parameterized queries or stored procedures for any database operations that use the Title parameter to eliminate injection paths.
  • Ensure that the btn_functions.php endpoint is protected by authentication and appropriate authorization checks to limit access to trusted users.
  • Introduce input validation to sanitize or escape the Title argument before it is processed.

Generated by OpenCVE AI on October 2, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 03 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation of the argument Title results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Title SourceCodester Online Reviewer Management System btn_functions.php activity sql injection
First Time appeared Sourcecodester
Sourcecodester online Reviewer Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester online Reviewer Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Online Reviewer Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-02T18:16:02.481Z

Reserved: 2026-10-01T18:29:07.832Z

Link: CVE-2026-104123

cve-icon Vulnrichment

Updated: 2026-10-02T18:15:55.657Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T03:16:39.047

Modified: 2026-10-02T19:16:40.637

Link: CVE-2026-104123

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T04:30:07Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')