CVE-2026-102910 in Online Reviewer Management System
Summary
by MITRE • 09/30/2026
A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument test_id results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The SourceCodester Online Reviewer Management System version 1.0 contains a critical security vulnerability located within the administrative module responsible for managing examination assessments. Specifically, the flaw resides in the exam-delete.php script situated at /reviewer_0/admins/assessments/examproper/. This component is designed to handle the deletion of existing exams from the system database by processing an identifier passed via the test_id argument. The vulnerability arises because this parameter is not adequately sanitized or validated before being incorporated into a SQL query executed against the backend database management system.
This lack of input validation allows for a classic SQL injection attack vector, classified under Common Weakness Enumeration as CWE-89 Improper Neutralization of Special Elements used in an SQL Command. An attacker can manipulate the test_id parameter by injecting malicious SQL code instead of providing a valid integer identifier. Because this functionality is part of the administrative interface, it typically requires some level of authentication; however, if credentials are compromised or if the system lacks robust access controls, any authenticated user with permission to manage assessments could potentially exploit this flaw. The vulnerability enables an attacker to interfere with the queries that the application makes to its database, effectively bypassing security checks and gaining unauthorized control over the data stored within the management system.
The operational impact of this SQL injection is severe and multifaceted. An adversary can use this vector to extract sensitive information from the database, including user credentials, personal identifiable information associated with reviewers or students, and confidential examination content. Beyond data exfiltration, a skilled attacker could potentially modify existing records, delete critical assessment data entirely, or even execute administrative commands on the underlying database server depending on its configuration privileges. This compromises the integrity, confidentiality, and availability of the entire review management platform. The fact that an exploit has been released to the public significantly lowers the barrier for entry, allowing less sophisticated threat actors to launch automated attacks against vulnerable instances without needing to develop custom payloads from scratch.
From a tactical perspective, this vulnerability aligns with ATT&CK techniques related to SQL Injection and Data Exfiltration. Attackers may leverage tools like sqlmap or manual injection strings to probe the application for weaknesses in input handling. The remote nature of the attack means that exploitation does not require physical access to the server, making it a high-risk vector for web-based applications deployed on public-facing networks. Organizations relying on this open-source solution must recognize that such projects often lack rigorous security auditing and ongoing maintenance compared to commercial enterprise software solutions.
To mitigate this vulnerability, immediate remediation is required by developers or system administrators maintaining instances of the SourceCodester Online Reviewer Management System. The primary fix involves implementing parameterized queries or prepared statements for all database interactions involving user-supplied input, specifically targeting the test_id variable in the exam-delete.php file. This ensures that the database treats the input strictly as data rather than executable code. Additionally, developers should implement strict input validation to ensure that expected parameters match their defined types and formats before processing. On an infrastructure level, deploying a Web Application Firewall can provide a layer of defense by detecting and blocking common SQL injection patterns in HTTP requests. Regular security assessments and penetration testing are also recommended to identify similar flaws across other modules within the application suite.