CVE-2026-109620 in Online Reviewer System
Summary
by MITRE • 10/13/2026
A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The SourceCodester Online Reviewer System version 1.0 contains a critical security flaw rooted in improper input validation within its authentication mechanism. Specifically, the vulnerability resides in the login functionality located at index.php, where the application interacts with a database using PHP Data Objects (PDO). The core issue arises from how the PDO::prepare function is utilized during the execution of SQL queries for user authentication. Instead of properly binding parameters to prevent code injection, the system appears to concatenate or improperly handle the username and password inputs directly within the query structure. This architectural oversight allows an attacker to inject malicious SQL commands that are interpreted by the database engine as part of the original query logic rather than as literal data values.
This flaw constitutes a classic example of SQL Injection, which is categorized under CWE-89 in the Common Weakness Enumeration standards. The vulnerability enables remote attackers to manipulate the authentication process without valid credentials. By crafting specific input strings containing SQL syntax, an attacker can bypass login checks, extract sensitive information from the database such as user hashes and personal data, or potentially modify application state. Since this is a web-based system accessible over network interfaces, the attack vector is classified as remote, allowing exploitation by any entity with connectivity to the target server. The presence of public exploits further lowers the barrier for entry, making this vulnerability highly actionable for automated scanning tools and opportunistic attackers alike.
From an operational perspective, successful exploitation can lead to a complete compromise of user accounts associated with the system. Attackers may gain unauthorized administrative access if they successfully extract or guess credentials from the backend database. This aligns with several techniques in the MITRE ATT&CK framework, particularly T1078 Valid Accounts and T1190 Exploit Public-Facing Application. The impact extends beyond simple account takeover; depending on the underlying database configuration and privileges granted to the application's database user, an attacker might execute administrative commands, dump entire tables, or even achieve remote code execution through specific database features like xp_cmdshell in Microsoft SQL Server or LOAD_FILE in MySQL.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary fix involves refactoring the login/index.php file to ensure that all user-supplied inputs are strictly parameterized using prepared statements with bound parameters, rather than string concatenation. Developers should verify that PDO::prepare is used correctly by passing variables as an array to execute(), ensuring they are treated exclusively as data. Additionally, implementing input validation and sanitization routines can provide a defense-in-depth layer, although this should never replace proper parameterization. Access controls such as rate limiting on login endpoints can also help mitigate brute-force attempts that often accompany SQL injection exploitation. Regular security audits and static code analysis tools configured to detect SQLi patterns are recommended to prevent similar issues in future development cycles.