| 标题 | Fabian Ros (Code-Projects) Online Reviewer System 1.0 Unauthenticated SQL Injection |
|---|
| 描述 | A critical vulnerability was discovered in Code-Projects Online Reviewer System 1.0. This vulnerability affects the user update logic within the file /reviewer/system/system/admins/manage/users/btn_functions.php. The manipulation of unsanitized HTTP POST parameters (such as the password parameter) leads to an unauthenticated SQL injection. By injecting SQL comment syntax (e.g., ---), an attacker can truncate the original session-based WHERE clause. An attacker can exploit this issue to perform a Mass Account Takeover (Mass ATO) and absolute privilege escalation by arbitrarily overwriting the credentials and administrative roles (usertype_id) of all users in the database simultaneously. The attack can be initiated remotely and requires no prior authentication or valid session.
-----------------------------------------
* NOTES FOR CNA ADMIN REGARDING PREREQUISITES *
Vendor Contact: This is an community project from Code-Projects. There is no valid security contact, email, or active support channel available to reach the developer. Due to this limitation, the vulnerability has been publicly disclosed on GitHub.
Previous CNA Submission: I originally submitted this vulnerability to MITRE (Ticket ID: 2103968 ) 15 days ago. As there has been no response and the vulnerability details have been publicly available on my GitHub repository for 2 weeks, I am requesting a CVE assignment via VulDB to ensure timely processing. I have already sent an email to withdraw the MITRE request to prevent any duplication. |
|---|
| 来源 | ⚠️ https://github.com/thuong2206/Unauthenticated-SQL-Injection-in-Online-Reviewer-System |
|---|
| 用户 | thuong2206 (UID 101615) |
|---|
| 提交 | 2026-09-24 17時24分 (18 日前) |
|---|
| 管理 | 2026-10-11 21時18分 (17 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 416775 [code-projects Online Reviewer System 1.0 User Update btn_functions.php SQL注入] |
|---|
| 积分 | 20 |
|---|