Description
A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
Published: 2026-09-20
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Remote SQL Injection leading to data exposure
Action: Patch Deployment
AI Analysis

Impact

A flaw in the file /reviewer_0/admins/assessments/databank/btn_functions.php the ability to manipulate the ID argument causes a direct SQL injection. The flaw allows an attacker to embed arbitrary SQL commands that are executed against the database, potentially extracting sensitive data, modifying records, or deleting information. It is a classic SQL injection vulnerability that can also be grouped under non‑validated input weaknesses.

Affected Systems

The vulnerability affects SourceCodester Online Reviewer Management System version 1.0, specifically the administrative remove action within the btn_functions.php script. The system can be run on any web server provided by SourceCodester and is accessible through the web interface.

Risk and Exploitability

With a CVSS score of 6.9 the flaw is considered of moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be launched remotely, and an exploit has already been published, indicating that the risk to unpatched installations is non‑negligible.

Generated by OpenCVE AI on September 20, 2026 at 10:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the SourceCodester Online Reviewer Management System to the latest patched version if one is released by the vendor.
  • Sanitize and validate the ID parameter in btn_functions.php to ensure that only numeric values are accepted before using it in database queries.
  • Implement prepared statements or parameterized queries in the PHP code to eliminate the possibility of injecting arbitrary SQL.

Generated by OpenCVE AI on September 20, 2026 at 10:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 09:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
Title SourceCodester Online Reviewer Management System btn_functions.php remove sql injection
First Time appeared Sourcecodester
Sourcecodester online Reviewer Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester online Reviewer Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Online Reviewer Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-20T09:00:10.359Z

Reserved: 2026-09-19T10:21:42.747Z

Link: CVE-2026-93974

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-20T09:16:39.693

Modified: 2026-09-20T09:16:39.693

Link: CVE-2026-93974

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T10:30:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')