# CVE-2026-108956: code-projects Online Reviewer System SQL injection in user update

Source: https://junglewise.ai/threats/cve-2026-108956-a-vulnerability-was-identified-in-code-projects-online-reviewer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108956 · Severity: high · CVSS 7.3 · Published 2026-10-13

Online Reviewer System is a PHP-based web application for managing code review workflows. An unauthenticated SQL injection vulnerability in the user management feature allows attackers to bypass authentication and modify user accounts, passwords, and privileges without logging in. This can lead to complete system compromise, including takeover of administrator accounts and unauthorized access to the entire application.

Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-108956 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108956 being exploited in the wild.

**How severe is CVE-2026-108956?** High severity, with a CVSS score of 7.3, published 13 October 2026.

**Which products and versions are affected?** Code-Projects Online Reviewer System 1.0.

**Is there a fix for CVE-2026-108956?** No fixed version is recorded yet. <UNKNOWN> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108956 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108956?** Check whether you run Code-Projects Online Reviewer System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


<UNKNOWN>

## Technical details

An unauthenticated SQL injection exists in /reviewer/system/system/admins/manage/users/btn_functions.php's user update handler, where unsanitized POST parameters are directly interpolated into an UPDATE SQL statement. An attacker can inject SQL comment syntax into the password parameter to truncate the WHERE clause that restricts updates to the authenticated user, allowing arbitrary modification of any user record in the database. The vulnerability requires only network access with a crafted HTTP POST request and yields write access to the users table without authentication.

## Affected products

- code-projects Online Reviewer System 1.0

## Timeline

- 2026-10-13: disclosed

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/thuong2206/Unauthenticated-SQL-Injection-in-Online-Reviewer-System](https://github.com/thuong2206/Unauthenticated-SQL-Injection-in-Online-Reviewer-System)

## Related threats

- [code-projects Online Reviewer System privilege escalation via mass assignment](https://junglewise.ai/threats/cve-2026-108948-a-vulnerability-has-been-found-in-code-projects-online-reviewer)