The vulnerability arises from improper handling of the ‘Description’ parameter in the btn_functions.php file, enabling an attacker to inject malicious JavaScript. When executed, the injected script runs in the victim’s browser, allowing the attacker to hijack sessions, deface pages, or phish for credentials. This is a classic reflected or stored Cross‑Site Scripting flaw, identified as CWE‑79, with potential use of arbitrary code execution via dynamic PHP execution (CWE‑94).

The flaw affects the code‑projects Online Reviewer System, versions up to and including 1.0. The issue resides in the file located at /system/system/students/assessments/databank/btn_functions.php. No higher versions are mentioned, so the vulnerability is limited to the stated product versions.

The CVSS score of 4.8 indicates a moderate risk level. The exploit is known to be reachable from remote web requests and has been publicly disclosed, but no exploitability metrics (EPSS) are available. As it is not listed in CISA’s Known Exploited Vulnerabilities catalog, the likelihood of widespread exploitation is uncertain, though attackers could readily craft malicious payloads to target users if the system remains unpatched.