The vulnerability occurs in the /system/system/students/assessments/pretest/take/index.php file of code-projects Online Reviewer System 1.0. A malformed or manipulated ID argument is interpreted directly by the underlying SQL engine, enabling an attacker to inject arbitrary SQL commands. The impact is the potential disclosure and manipulation of data stored in the database, compromising confidentiality and integrity. The fault stems from improper handling of user-supplied input, reflected in the listed weaknesses CWE‑74 and CWE‑89.

The affected product is code-projects Online Reviewer System version 1.0. No additional sub‑product versions are listed, and the vulnerability is tied to functionality in the pretest take interface of the application.

The CVSS score for this issue is 6.9, indicating a moderate-to-high risk. Although the EPSS score is below 1% and the vulnerability is not in the CISA KEV catalog, the exploit is publicly disclosed and can be triggered remotely by supplying a crafted ID value. Successful exploitation would allow an attacker to retrieve or alter database contents without authentication, making this a high‑impact flaw for systems lacking mitigation.