The vulnerability exists in the User Update Handler component of code-projects Online Reviewer System 1.0, specifically an unprotected function within btn_functions.php. An attacker can embed malicious SQL code into input fields, causing the backend to execute unintended database statements. This flaw is a classic SQL injection, classified under CWE-74 and CWE-89, and can be exploited remotely without authentication, potentially allowing attackers to read, modify, or delete sensitive data in the underlying database.

This issue affects the code-projects Online Reviewer System version 1.0. Administrators running this edition should assess whether the User Update Handler has been deployed, as the impacted file resides under /reviewer/system/system/admins/manage/users/btn_functions.php. The application is distributed by code-projects, and the vulnerability has not been reported for later versions, so only the 1.0 release is explicitly impacted.

The CVSS score of 6.9 indicates a medium severity vulnerability. The EPSS score is not available, but the publicly available exploit, as noted in the advisory, suggests that attackers could actively target this flaw. Because the injection can be performed remotely, an attacker can potentially gain unauthorized database access, compromise data confidentiality, integrity, and availability. The vulnerability is not listed in the CISA KEV catalog. Immediate patching is recommended to mitigate this risk.