Executive brief
SourceCodester Online Reviewer Management System is a PHP-based web application for managing code review workflows. An SQL injection vulnerability in the assessment subject removal function allows unauthenticated attackers to manipulate the database, potentially leading to unauthorized data access, modification, deletion, and system compromise.
Technical details
An SQL injection vulnerability exists in btn_functions.php (action=remove) where the 'id' parameter is passed directly into SQL queries without sanitization or prepared statements. The vulnerability is remotely exploitable without authentication and can be exploited via boolean-based blind, error-based, stacked queries, or time-based blind SQL injection techniques.
Affected products
- SourceCodester Online Reviewer Management System 1.0
Timeline
- 2026-08-24: disclosed: Vulnerability reported on GitHub
- 2026-09-20: advisory: NVD published CVE-2026-93973