Executive brief
The Sourcecodester Online Reviewer System, a web application for managing and taking exams, contains a security flaw that allows an administrative user to perform unauthorized database queries. By exploiting this vulnerability, an attacker with administrative credentials could access sensitive information stored in the database beyond what they are normally permitted to see. This could lead to the exposure of system configuration details or other internal data.
Technical details
A SQL injection vulnerability exists in Sourcecodester Online Reviewer System v1.0 within the 'id' parameter of the /system/system/admins/assessments/examproper/questions-view.php file. The application fails to properly sanitize user-supplied input before using it in a SQL query, enabling Union-based SQL injection. An attacker with high privileges (administrative access) can exploit this over the network to execute arbitrary SQL commands and leak database information, such as the database name. The vulnerability was identified in environments running PHP 8.1 via XAMPP.
Affected products
- Sourcecodester Online Reviewer System 1.0
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory