CVE-2026-102908: Online Reviewer Management System SQLI

CVE-2026-102908 Overview

CVE-2026-102908 is a SQL injection vulnerability affecting SourceCodester Online Reviewer Management System 1.0. The flaw resides in the /reviewer_0/admins/assessments/examproper/questions-view.php script, where the ID parameter is passed to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is exploitable remotely without authentication or user interaction. Public disclosure of the exploit technique increases the likelihood of opportunistic scanning and exploitation against exposed deployments.

Critical Impact
Unauthenticated remote attackers can inject SQL commands through the ID parameter, potentially disclosing, altering, or destroying stored assessment and user data.

Affected Products

SourceCodester Online Reviewer Management System 1.0
Vulnerable script: /reviewer_0/admins/assessments/examproper/questions-view.php
Vulnerable parameter: ID

Discovery Timeline

2026-09-30 - CVE-2026-102908 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102908

Vulnerability Analysis

The vulnerability is classified under CWE-74 as improper neutralization of special elements in output used by a downstream component (injection). The questions-view.php endpoint accepts the ID argument from the HTTP request and concatenates it directly into a SQL query executed against the backend database.

Because the input is neither parameterized nor validated, an attacker can break out of the intended query context. Payloads containing SQL metacharacters such as single quotes, UNION SELECT, or boolean-based logic can modify query semantics. Successful injection allows attackers to read arbitrary tables, enumerate credentials, or manipulate assessment records.

The endpoint sits within an administrative path, but the CVSS vector reports no privileges required. This indicates the admin route lacks enforced authentication, exposing the injection point to any remote requester.

Root Cause

The root cause is direct string concatenation of user-controllable input into a SQL statement inside questions-view.php. The application does not use prepared statements or parameterized queries. There is no input allow-listing or type coercion for the ID argument, which should represent a numeric identifier.

Attack Vector

An attacker sends a crafted HTTP GET or POST request to /reviewer_0/admins/assessments/examproper/questions-view.php with a manipulated ID parameter. The injected payload alters the SQL query executed by the backend. No credentials, tokens, or user interaction are required. Successful exploitation yields read and write access to the underlying database, subject to the DBMS account privileges used by the application. Refer to the GitHub CVE Issue Discussion and VulDB entry for CVE-2026-102908 for technical detail.

Detection Methods for CVE-2026-102908

Indicators of Compromise

HTTP requests to /reviewer_0/admins/assessments/examproper/questions-view.php containing SQL metacharacters such as ', ", --, ;, or encoded variants in the ID parameter.
Requests to the vulnerable endpoint containing UNION, SELECT, SLEEP(, BENCHMARK(, or INFORMATION_SCHEMA tokens.
Unexpected database error messages returned to clients or logged by the web server after requests to the endpoint.
Anomalous spikes in response time from questions-view.php, indicating time-based blind SQL injection probing.

Detection Strategies

Enable database query logging and alert on queries originating from questions-view.php that reference schema metadata tables.
Deploy web application firewall (WAF) signatures for common SQL injection payloads against the ID parameter path.
Correlate web server access logs with database error logs to identify probing sequences from a single source IP.
Baseline normal request patterns for the endpoint and flag requests whose ID value contains non-numeric characters.

Monitoring Recommendations

Forward web server, application, and database logs to a central analytics platform for correlation and retention.
Monitor outbound connections from the database host that may indicate data exfiltration following successful injection.
Track authentication events and privilege changes on the database account used by the application.

How to Mitigate CVE-2026-102908

Immediate Actions Required

Restrict network access to the /reviewer_0/admins/ administrative path using IP allow-lists or VPN gating until a patch is applied.
Deploy a WAF rule blocking SQL metacharacters and injection keywords in the ID parameter for questions-view.php.
Audit the application database for unauthorized changes to assessment records, question banks, and administrator accounts.
Rotate database credentials and any secrets that may have been exposed through prior queries.

Patch Information

As of publication, no official vendor patch has been referenced in the CVE record. Monitor the SourceCodester website for updates. Until a fix is released, replace direct query concatenation in questions-view.php with parameterized queries using PDO or mysqli prepared statements, and cast the ID argument to an integer before use.

Workarounds

Enforce authentication on all /reviewer_0/admins/ endpoints via web server configuration or application-level middleware.
Apply the principle of least privilege to the database account used by the application, revoking INFORMATION_SCHEMA and FILE privileges where possible.
Disable verbose SQL error output to prevent attackers from receiving diagnostic feedback during injection attempts.

bash

# Example Apache configuration restricting admin path by source IP
<Location "/reviewer_0/admins/">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>

# Example ModSecurity rule blocking SQLi tokens in the ID parameter
SecRule REQUEST_URI "@contains /reviewer_0/admins/assessments/examproper/questions-view.php" \
    "chain,id:1029080,phase:2,deny,status:403,msg:'Block SQLi on ID parameter'"
    SecRule ARGS:ID "@rx (?i)(union|select|sleep\(|benchmark\(|information_schema|--|;|')" "t:none"