CVE-2026-95924 in Online Reviewer Management System
Summary
by MITRE • 09/23/2026
A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. The manipulation of the argument difficulty_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The SourceCodester Online Reviewer Management System version 1.0 contains a critical security flaw within its administrative assessment module, specifically located in the file reviewer_0/admins/assessments/databank/btn_functions.php when handling the action parameter set to add. This vulnerability manifests as an SQL injection weakness triggered by improper validation and sanitization of the difficulty_id input argument. The application fails to properly filter user-supplied data before incorporating it into backend database queries, allowing attackers to inject arbitrary Structured Query Language commands directly into the execution context of the web server.
This specific instance represents a classic blind or error-based SQL injection vector where the lack of parameterized queries or strict type checking enables malicious actors to manipulate the underlying database structure and content. By crafting a specially constructed HTTP request with a modified difficulty_id value, an attacker can bypass authentication mechanisms, extract sensitive data such as user credentials and personal information stored in the system's database, modify existing records, or potentially execute administrative commands depending on the privileges of the database account running the web application. The vulnerability is classified under CWE-89 Improper Neutralization of Special Elements used in an SQL Command which highlights the fundamental failure to sanitize input data against special characters that have meaning within SQL syntax such as single quotes and semicolons.
The operational impact of this vulnerability is severe due to its remote exploitability, allowing attackers to initiate attacks from any network location without requiring prior authentication or local access. Since the affected endpoint resides in an administrative section of the application, successful exploitation could lead to a complete compromise of the system's integrity and confidentiality. Attackers can leverage ATT&CK technique T1059 Command and Scripting Interpreter through SQL injection payloads to achieve remote code execution if the database engine permits it, or utilize T1114 Email Collection by exfiltrating stored email addresses for further phishing campaigns. The disclosure of public exploits significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and exploitation attempts against vulnerable instances deployed on production networks.
Mitigation strategies must focus immediately on implementing input validation and output encoding practices that adhere to secure coding standards defined by organizations such as OWASP. Developers should replace direct string concatenation in SQL queries with prepared statements or parameterized queries which ensure that user input is treated strictly as data rather than executable code. Additionally, applying the principle of least privilege to database accounts used by the web application can limit the damage caused if an injection succeeds. Network-level defenses such as Web Application Firewalls should be configured to detect and block common SQL injection patterns targeting this specific endpoint while a permanent patch addressing the input sanitization logic is developed and deployed.