A function in the admin update endpoint allows an attacker to supply a malicious test_id that is inserted into an SQL query without adequate sanitization. Because the file is reachable via a normal HTTP request, the flaw can be triggered remotely. Successful exploitation could let an attacker read, modify, or delete review data stored in the database, compromising confidentiality, integrity, or availability of the system.

SourceCodester Online Reviewer Management System version 1.0; the vulnerability resides in the /reviewer_0/admins/assessments/pretest/btn_functions.php file accessed via the action=update query.

The flaw carries a CVSS score of 6.9, indicating medium severity, and is not listed in the CISA KEV database. The EPSS score is not available, so the exact likelihood of exploitation remains uncertain, but public disclosure and remote reachability suggest that attackers could exercise it over the network. Attackers would need to craft a request with a malicious test_id parameter targeting the update action.