Description
A vulnerability was identified in code-projects Online Reviewer System 1.0. This impacts an unknown function of the file /system/system/admins/assessments/pretest/btn_functions.php. Such manipulation of the argument difficulty_id leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Published: 2026-02-09
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Apply Patch
AI Analysis

Impact

A vulnerability was discovered in Online Reviewer System 1.0, specifically in an undocumented function within /system/system/admins/assessments/pretest/btn_functions.php. An attacker can manipulate the difficulty_id argument, resulting in SQL injection that the system accepts and executes remotely. This flaw permits executing arbitrary SQL commands, which could lead to unauthorized reading, modification, or deletion of database data, potentially compromising confidentiality, integrity, and availability.

Affected Systems

The affected product is code-projects Online Reviewer System, version 1.0.

Risk and Exploitability

The CVSS score of 6.9 classifies the issue as moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely in the wild. The vulnerability is not listed in CISA’s KEV catalog, indicating no known large-scale exploitation. Organizations using the vulnerable version should treat the flaw as a moderate risk that could enable exploitation of the database if left unmitigated.

Generated by OpenCVE AI on April 18, 2026 at 13:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or upgrade to a version of Online Reviewer System that has fixed the SQL injection vulnerability.
  • If no patch is currently available, restrict access to the admin functionality that contains the vulnerability or temporarily disable the affected feature until a fix can be applied.
  • Implement stringent input validation by ensuring that the difficulty_id parameter is an integer and use prepared statements or parameterized queries to construct database commands.
  • Regularly monitor database logs for suspicious SQL activity that might indicate exploitation attempts.

Generated by OpenCVE AI on April 18, 2026 at 13:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Fabian
Fabian online Reviewer System
CPEs cpe:2.3:a:fabian:online_reviewer_system:1.0:*:*:*:*:*:*:*
Vendors & Products Fabian
Fabian online Reviewer System

Tue, 10 Feb 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects online Reviewer System
Vendors & Products Code-projects
Code-projects online Reviewer System

Mon, 09 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Feb 2026 06:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in code-projects Online Reviewer System 1.0. This impacts an unknown function of the file /system/system/admins/assessments/pretest/btn_functions.php. Such manipulation of the argument difficulty_id leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Title code-projects Online Reviewer System btn_functions.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Reviewer System
Fabian Online Reviewer System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:58:04.941Z

Reserved: 2026-02-08T15:59:57.194Z

Link: CVE-2026-2220

cve-icon Vulnrichment

Updated: 2026-02-09T15:55:52.511Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-09T07:16:18.687

Modified: 2026-02-10T14:00:53.970

Link: CVE-2026-2220

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T13:15:25Z

Weaknesses