CVE-2026-104123 in Online Reviewer Management System
Summary
by MITRE • 10/02/2026
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation of the argument Title results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The SourceCodester Online Reviewer Management System version 1.0 contains a critical security flaw within its administrative interface, specifically located in the file reviewer_0/admins/assessments/activities/btn_functions.php when invoked with the action parameter set to activity. This vulnerability manifests as an SQL injection weakness triggered by improper handling of user-supplied input passed via the Title argument. The application fails to adequately sanitize or validate this specific parameter before incorporating it into backend database queries, allowing malicious actors to inject arbitrary Structured Query Language commands directly into the system's data layer.
This flaw aligns with Common Weakness Enumeration identifier CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command. The absence of prepared statements or parameterized queries for this specific input vector means that any string provided by a user is interpreted as executable code rather than literal data. This architectural deficiency enables attackers to bypass authentication mechanisms, extract sensitive information from the database such as administrator credentials and personal reviewer details, modify existing records, or potentially execute administrative commands on the underlying database server depending on its configuration and privileges granted to the web application account.
The operational impact of this vulnerability is severe due to its remote exploitability. An attacker does not require prior authentication or physical access to launch an attack against the system. Since the vulnerable endpoint is part of a management system, successful exploitation could lead to a complete compromise of the integrity and confidentiality of the platform's data. Attackers can leverage public exploits that are already available in the wild to automate attacks, making this vulnerability particularly dangerous for organizations still running unpatched instances of this software. The exposure allows for unauthorized access to sensitive academic or organizational records managed by the reviewer system.
Mitigation strategies must focus on immediate remediation and defensive coding practices. The primary solution is to refactor the affected PHP code in btn_functions.php to use parameterized queries or prepared statements, ensuring that all user inputs are treated strictly as data rather than executable SQL syntax. Input validation should also be implemented to enforce strict type checking and length constraints on the Title field. Additionally, organizations running this system should apply any available patches from SourceCodester if provided, restrict network access to administrative interfaces using firewalls or IP whitelisting where possible, and conduct a thorough audit of other endpoints for similar injection flaws given that weak input handling often indicates broader code quality issues within the application architecture.