The vulnerability resides in the PDO::prepare call within login/index.php of SourceCodester's Online Reviewer System 1.0. Malicious input supplied for the username or password permits an attacker to inject arbitrary SQL. Because the query string is constructed without proper sanitization, the attacker can manipulate the statement sent to the database. If the database query succeeds, the attacker may extract, modify, or delete sensitive data from the system, potentially compromising the confidentiality and integrity of stored information.

This flaw affects SourceCodester's Online Reviewer System across all installations running version 1.0. Vendors are SourceCodester; the product name is Online Reviewer System. No other vendors or product versions are explicitly listed in the CNA data. There is no indication that patched versions exist, so manual mitigation may be required until an official update is released.

The CVSS score of 6.9 indicates a moderate impact. The EPSS score is not available, but the vulnerability is publicly disclosed and can be exploited remotely over the network. Because it is not listed in CISA's KEV catalog, there is currently no known active exploitation in the wild, yet the remote nature and lack of defensive controls suggest that opportunistic attackers could use automated scripts to target vulnerable instances.