SQL injection occurs in the exam-update.php script of Sourcecodester Online Reviewer System v1.0. The script fails to properly sanitize user input, allowing an attacker to embed malicious SQL statements into the application's queries. If an attacker can reach this page, they could read, modify, or delete records in the exam database, leading to data theft or integrity loss.

Sourcecodester Online Reviewer System version 1.0. The vulnerability is located in the file /system/system/admins/assessments/examproper/exam-update.php. No other vendors or product versions are reported as affected.

Because the flaw resides in an administrative page, the likely attack vector is remote via the exposed admin interface. The attacker probably needs valid administrator credentials to trigger the injection, although unauthenticated access could be possible if the site is misconfigured. No CVSS score or EPSS value is provided, and the vulnerability is not listed in the CISA KEV catalog, but the potential for data exfiltration and database corruption is high if the flaw is exploited.