The vulnerability involves an SQL injection flaw in the loaddata.php component of Online Reviewer System 1.0. By manipulating the difficulty_id argument, an attacker can inject arbitrary SQL commands, potentially allowing data exfiltration or modification. The flaw is classified under CWE-74 and CWE-89, typical examples of unsanitized input leading to injection attacks.

The flaw affects code-projects' Online Reviewer System, version 1.0. No other versions were listed in the advisory. The exposure occurs in the /system/system/admins/assessments/pretest/loaddata.php file of the 1.0 release, and the affected CPE is cpe:2.3:a:fabian:online_reviewer_system:1.0:…. Administrators using this package should verify their installed version.

The CVSS score is 6.9, indicating moderate severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation at present. The vulnerability can be triggered remotely via HTTP requests to the affected endpoint, and the exploit is publicly available. Though it has not been listed in the CISA KEV catalog, the public availability combined with the remote attack vector warrants timely remediation.