The flaw resides in the btn_functions.php script of the admin section of the Online Reviewer Management System. By sending a specially crafted Title parameter to the update action, an attacker can inject arbitrary SQL. The injected code is executed against the database, allowing the attacker to read, modify, or delete data from the system. This falls under CWE-74 and CWE-89.

Affected products include SourceCodester Online Reviewer Management System version 1.0. The vulnerable code resides in the /reviewer_0/admins/assessments/activities/btn_functions.php file. No other versions or products are listed in the CNA data.

The CVSS base score of 6.9 indicates moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting that while the vulnerability is publicly known, there is no evidence of widespread exploitation. The attack can be performed remotely and may require authenticated access to the admin update endpoint, but the description does not specify authentication requirements. Because the exploit has been publicly released, there is a non-zero chance that attackers may already attempt to exploit it.