Description
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update. Performing a manipulation of the argument Subject results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
Published: 2026-10-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Database Compromise
Action: Patch Immediately
AI Analysis

Impact

A SQL injection flaw exists in the update action of the file /reviewer_0/admins/assessments/Subject/btn_functions.php within SourceCodester Online Reviewer Management System 1.0. By manipulating the 'Subject' parameter, an attacker can inject arbitrary SQL statements into the backend database query. If successful, this could allow the attacker to read, modify, or delete data stored in the database, effectively compromising the integrity and confidentiality of the application’s data. The weakness corresponds to CWE-89 (SQL Injection) and CWE-74 (Unvalidated Input for SQL). The vulnerability targets the SourceCodester Online Reviewer Management System, version 1.0, deployed by SourceCodester. Any installation that exposes the admin update endpoint at /reviewer_0/admins/assessments/Subject/btn_functions.php is affected. The issue resides specifically in the Subject update functionality of that file.

Affected Systems

The affected product is SourceCodester Online Reviewer Management System version 1.0. The vulnerability is specific to the admin update endpoint /reviewer_0/admins/assessments/Subject/btn_functions.php accessed via the 'update' action. Any installation exposing this endpoint is at risk.

Risk and Exploitability

The flaw carries a CVSS v3.1 score of 6.9, indicating medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The public description states that the attack can be initiated remotely via crafted HTTP requests to the update URL. Authentication requirements are not specified, so the exact accessibility remains uncertain. However, the lack of input validation makes the exploit straightforward, and public exploit code has been released.

Generated by OpenCVE AI on October 5, 2026 at 09:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any vendor‑supplied patch or upgrade to a version that validates the Subject parameter.
  • Refactor database queries in the update logic to use parameter binding and prepared statements instead of concatenating user input into SQL.
  • Restrict access to the admin update endpoint through authentication, IP whitelisting, or firewall rules to limit exposure to trusted administrators.

Generated by OpenCVE AI on October 5, 2026 at 09:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update. Performing a manipulation of the argument Subject results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
Title SourceCodester Online Reviewer Management System btn_functions.php update sql injection
First Time appeared Sourcecodester
Sourcecodester online Reviewer Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester online Reviewer Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Online Reviewer Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-05T14:17:23.457Z

Reserved: 2026-10-04T16:32:21.772Z

Link: CVE-2026-105246

cve-icon Vulnrichment

Updated: 2026-10-05T14:16:27.402Z

cve-icon NVD

Status : Deferred

Published: 2026-10-05T07:16:30.630

Modified: 2026-10-06T15:04:52.637

Link: CVE-2026-105246

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-05T10:00:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')