CVE-2026-102909 in Online Reviewer Management System
Summary
by MITRE • 09/30/2026
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/examproper/btn_functions.php. The manipulation of the argument access_code leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The SourceCodester Online Reviewer Management System version 1.0 contains a critical security flaw within its administrative assessment module, specifically located in the file reviewer_0/admins/assessments/examproper/btn_functions.php. This vulnerability arises from an improper neutralization of special elements used in an SQL command, commonly known as SQL injection. The root cause is traced to the handling of the access_code argument, which is passed into a database query without adequate sanitization or parameterization. Because this input vector is not properly validated against expected formats or escaped for safe execution within Structured Query Language statements, it allows an attacker to inject arbitrary SQL commands that are subsequently executed by the backend database server.
This flaw represents a classic instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command, which is consistently ranked among the most dangerous web application vulnerabilities due to its potential for data exfiltration and system compromise. The vulnerability exists within a function that processes access codes, likely intended to verify user permissions or unlock specific assessment content. By manipulating this argument, an attacker can bypass authentication mechanisms, extract sensitive information from the database such as administrator credentials or personal user data, modify existing records, or potentially execute administrative commands depending on the privileges of the database account running the web application.
The operational impact of this vulnerability is severe given that it allows for remote exploitation without requiring prior authentication in many configurations involving access code validation logic. Since the exploit is publicly available, automated scanning tools and malicious actors can easily identify and target instances of this software. An attacker could leverage this flaw to gain unauthorized access to the administrative interface or directly query the underlying database, leading to a complete compromise of system integrity and confidentiality. This aligns with ATT&CK technique T1059: Command and Scripting Interpreter if the SQL injection allows for out-of-band data retrieval that leads further into lateral movement, or more directly with T1190: Exploit Public-Facing Application, as it targets a known vulnerability in software deployed on internet-facing servers.
Mitigation strategies must focus immediately on securing the input handling within btn_functions.php. The primary remediation involves implementing parameterized queries or prepared statements for all database interactions involving user-supplied data such as access_code. This ensures that the database distinguishes between code and data, preventing injected SQL from being executed. Additionally, developers should apply strict input validation by whitelisting allowed characters for access codes rather than relying on blacklist approaches which are prone to bypasses. Deploying a Web Application Firewall can provide temporary protection by filtering malicious payloads before they reach the application logic, but this is not a substitute for fixing the underlying code defect. Updating to a patched version of the SourceCodester Online Reviewer Management System if available remains the most effective long-term solution.