Executive brief
SourceCodester's Online Reviewer Management System is a web application used to manage code reviews and assessments. An SQL injection flaw in the databank management function allows attackers to manipulate database queries remotely without authentication, potentially exposing, modifying, or deleting sensitive data stored in the system's database.
Technical details
The vulnerability is an unauthenticated SQL injection in the 'id' parameter of /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. The application directly concatenates user input into SQL queries without proper parameterization or validation, allowing attackers to inject multiple payload types (boolean-based blind, error-based, time-based blind, stacked queries). Exploitation enables full database compromise including data exfiltration, modification, and deletion.
Affected products
- SourceCodester Online Reviewer Management System 1.0
Timeline
- 2026-09-20: disclosed: Published advisory and proof-of-concept