The vulnerability resides in an unknown function within the /login/index.php file of version 1.0 of code-projects Online Reviewer System. By manipulating the Username argument, an attacker can inject arbitrary SQL statements, potentially gaining unauthorized access to or modifying the data stored in the underlying database. The flaw is a classic SQL injection (CWE-89) and also reflects input handling weaknesses (CWE-74).

The affected product is code-projects Online Reviewer System, version 1.0, running on the platform identified by the CPE cpe:2.3:a:fabian:online_reviewer_system:1.0:*:*:*:*:*:*:*. Users employing this outdated version are directly exposed to the flaw.

The CVSS base score of 6.9 indicates moderate to high risk. The EPSS score is below 1%, suggesting that, while the vulnerability exists and exploitation code is publicly available, the likelihood of an actual attack is relatively low at this time. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote, accessed through the web login interface, and requires only a crafted Username value to be sent to the vulnerable application. Because the flaw has been publicly disclosed, attackers can readily craft exploit payloads.