The vulnerability exists in the SourceCodester Online Reviewer Management System 1.0 and allows an attacker to manipulate the difficulty_id argument in the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. This manipulation exposes a classic SQL injection flaw that can be used to execute arbitrary SQL statements against the database. The result is unauthorized access, modification or deletion of data stored in the system’s database, potentially leading to data compromise or corruption. The weakness is categorized as CWE-74 and CWE-89, indicating inadequate input sanitization and classic SQL injection.

Product: SourceCodester Online Reviewer Management System, Version 1.0. Only the 1.0 release is known to be affected according to the CNA and CPE entries. Any installation that has not applied the appropriate update is considered vulnerable.

The CVSS score of 6.9 places the vulnerability in the medium severity range but still significant, as remote exploitation is possible via HTTP requests. The EPSS score for this CVE is not available, which does not preclude the likelihood of exploitation but suggests limited publicly observed activity. The vulnerability is not listed in the CISA KEV catalog, but the public disclosure of an exploit indicates that attackers may already be attempting to use it. Attackers can trigger the flaw by sending a crafted HTTP request to the action=add endpoint with an injected difficulty_id value. No special privileges are required beyond network access to the web application.