A SQL injection flaw exists in the questions-view.php file of the Online Reviewer System. By manipulating the ID argument, an attacker can embed arbitrary SQL code. This flaw can allow read or modification of the underlying database, exposing sensitive information or corrupting data. The vulnerability is a classic injection weakness, identified as CWE-74 and CWE-89. No authentication or privilege elevation is specifically required; the flaw is exploitable with a simple crafted input.

The affected product is code‑projects Online Reviewer System, version 1.0. The vulnerable code resides in /system/system/admins/assessments/pretest/questions-view.php. No other versions or builds are documented as affected in the available data.

The CVSS score is 6.9, indicating a moderate severity. EPSS shows an exploitation probability of less than 1 percent, and the vulnerability is not listed in the CISA KEV catalog. The attack can be carried out remotely by submitting a malicious ID value to the vulnerable endpoint. An attacker does not need any special permissions beyond access to the web interface to leverage this flaw.