Description
A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/course/btn_functions.php. Such manipulation of the argument courseID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-09-20
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Remote SQL injection enabling unauthorized database access
Action: Patch immediately
AI Analysis

Impact

A known SQL injection flaw exists in the Unknown function of /reviewer_0/admins/assessments/course/btn_functions.php in SourceCodester Online Reviewer Management System. The flaw arises when an attacker manipulates the courseID argument, which can be used to inject arbitrary SQL statements. This weakness is classified as CWE-74 (Improper Validation of Data Structures) and CWE-89 (SQL Injection). A successful exploitation permits an attacker to read sensitive data from the database or modify records, compromising confidentiality and integrity.

Affected Systems

The vulnerability is present in SourceCodester Online Reviewer Management System version 1.0. No other versions are mentioned in the data.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available. The exploit is noted as remote and publicly disclosed, but it is not listed in the CISA KEV catalog. The attack can be carried out via the web interface by manipulating the courseID parameter, with no special privilege or local access required. Given the moderate CVSS and lack of known mitigations in the public domain, the likelihood of exploitation remains unclear but should be treated with caution.

Generated by OpenCVE AI on September 20, 2026 at 09:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check SourceCodester for an official patch or newer release that addresses the SQL injection issue and apply it as soon as possible.
  • If a vendor patch is not available, review the btn_functions.php file and modify the courseID handling to use parameterized queries or stored procedures that prevent injection.
  • Deploy or update web application firewall rules to block malformed courseID parameters or suspect SQL patterns.
  • Restrict database permissions for the web application user to read‑only access wherever possible to limit the impact of any exploitation.

Generated by OpenCVE AI on September 20, 2026 at 09:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 08:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/course/btn_functions.php. Such manipulation of the argument courseID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Title SourceCodester Online Reviewer Management System btn_functions.php sql injection
First Time appeared Sourcecodester
Sourcecodester online Reviewer Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester online Reviewer Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Online Reviewer Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-20T07:45:07.351Z

Reserved: 2026-09-19T10:17:55.270Z

Link: CVE-2026-93972

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-20T08:16:51.433

Modified: 2026-09-20T08:16:51.433

Link: CVE-2026-93972

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T09:30:18Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')