A remote attacker can supply a crafted value for the difficulty_id argument in the action=update call of btn_functions.php. The argument is interpolated directly into an SQL statement, enabling the attacker to inject arbitrary SQL code and manipulate the database. This flaw can lead to data disclosure, modification, or deletion, impacting the confidentiality and integrity of the system’s reviewer data. The issue is thereby a classic SQL Injection (CWE-89) with an injection flaw that is already exposed to the public.

Affected systems: The vulnerability exists in SourceCodester’s Online Reviewer Management System version 1.0, specifically in the file /reviewer_0/admins/assessments/databank/btn_functions.php where the difficulty_id parameter is used without sanitisation. No other vendors or product versions are listed as affected.

The CVSS score of 6.9 indicates a medium severity assessment. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The exploit is remote, likely delivered via an HTTP request to the vulnerable endpoint, and the public availability of the exploit suggests that attackers can readily automate the injection. Given the lack of mitigations in the code base, the risk of exploitation remains high until a patch is applied.