Executive brief
SourceCodester Online Reviewer Management System is a PHP-based application for managing course assessments and reviews. An attacker can inject malicious SQL commands through the courseID parameter without authentication, allowing unauthorized database access, data theft, modification, or deletion of sensitive course and reviewer information.
Technical details
A SQL injection vulnerability exists in /reviewer_0/admins/assessments/course/btn_functions.php where the courseID parameter is passed directly into SQL queries without sanitization or parameterized statements. The vulnerability is exploitable remotely via HTTP GET requests and requires no authentication or user interaction. Attackers can extract arbitrary data, modify database contents, or potentially execute system commands depending on database configuration and permissions.
Affected products
- SourceCodester Online Reviewer Management System 1.0
Timeline
- 2026-08-24: disclosed
- 2026-09-20: advisory