A flaw in the Online Reviewer System 1.0 allows attackers to inject arbitrary SQL through the test_id parameter in exam-update.php. The injection can modify or read database contents, potentially exposing privileged information or altering assessment data. The CVE description confirms the ability to manipulate the argument test_id and states that the attack can be performed from remote. The vulnerability is sufficiently serious to warrant remediation.

This issue affects the code-projects Online Reviewer System version 1.0, specifically the file system/system/admins/assessments/pretest/exam-update.php. CPE information identifies the product as fabian online_reviewer_system 1.0. No additional affected versions are listed, so all installations of the 1.0 release are presumed vulnerable.

The CVSS score of 6.9 indicates a medium severity, while the EPSS score is below 1%, suggesting current exploitation activity is very low. The vulnerability is not listed in the CISA KEV catalog, which further implies limited public exploitation. However, the remote nature of the attack and the public knowledge of the exploit mean that once a patch is available, administrators should act promptly. The combination of remote access, potential data impact, and low current threat does not justify a zero‑day urgency, but it does warrant timely patching to mitigate future risk.