CVE-2026-102909: Online Reviewer Management System SQLi

CVE-2026-102909 Overview

CVE-2026-102909 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The flaw resides in the file /reviewer_0/admins/assessments/examproper/btn_functions.php, where the access_code parameter is passed to a database query without proper sanitization. Attackers can manipulate the argument to inject arbitrary SQL statements. The vulnerability is exploitable remotely without authentication or user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact

Remote, unauthenticated attackers can inject SQL through the access_code parameter to read, modify, or destroy data in the underlying database of the reviewer management application.

Affected Products

• SourceCodester Online Reviewer Management System 1.0
• Component: /reviewer_0/admins/assessments/examproper/btn_functions.php
• Parameter: access_code

Discovery Timeline

• 2026-09-30 - CVE-2026-102909 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102909

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-74] in the assessment handling logic of the Online Reviewer Management System. The btn_functions.php script processes the access_code request parameter and concatenates it directly into a SQL query. Because the input is neither validated nor bound as a parameter, database syntax supplied by the caller becomes part of the executed statement. An attacker can extract user credentials, exam data, or session artifacts. Depending on database privileges, the attacker may also modify records or attempt secondary attacks such as file writes through database engine features.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The application constructs queries using string concatenation with untrusted request data rather than using prepared statements with parameter binding.

Attack Vector

Exploitation requires only network access to the web application. The attacker issues a crafted HTTP request to the vulnerable endpoint with a malicious access_code value. No authentication or user interaction is needed. Public disclosure of the technique lowers the skill required to weaponize the flaw.

No verified proof-of-concept code is reproduced here. Refer to the VulDB Vulnerability Report and the GitHub Issue Tracker for technical writeups.

Detection Methods for CVE-2026-102909

Indicators of Compromise

• HTTP requests to /reviewer_0/admins/assessments/examproper/btn_functions.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #) in the access_code parameter.
• Unusual database error messages or unexpected response delays associated with requests to the affected endpoint.
• Web server access logs showing repeated requests to btn_functions.php from a single source with varying access_code payloads.

Detection Strategies

• Deploy web application firewall (WAF) signatures that inspect the access_code parameter for SQL injection patterns and boolean-based tautologies.
• Enable database query auditing to flag statements referencing schema metadata tables such as information_schema.tables from the application account.
• Correlate web access logs with database logs to identify anomalous query volume or long-running queries originating from the reviewer application.

Monitoring Recommendations

• Alert on HTTP 500 responses from the affected PHP script, which frequently accompany injection probes.
• Monitor egress traffic from the database host for anomalous outbound connections that may indicate data staging or exfiltration.
• Track authentication events for the application to detect account takeover following credential extraction.

How to Mitigate CVE-2026-102909

Immediate Actions Required

• Restrict network access to the reviewer management application to trusted networks or authenticated users via a reverse proxy or VPN.
• Deploy WAF rules that block SQL syntax in the access_code parameter until a code fix is applied.
• Rotate database credentials and application session secrets if evidence of exploitation is found.

Patch Information

No vendor patch has been referenced in the advisory data. Administrators should consult the SourceCodester Security Blog and the VulDB CVE Details page for updates. Where possible, modify btn_functions.php to use PDO or MySQLi prepared statements with bound parameters and enforce input validation on access_code.

Workarounds

• Apply an application-layer filter that rejects any access_code value not matching the expected alphanumeric format and length.
• Enforce least-privilege on the database account used by the application, removing DDL and write access where not required.
• Disable verbose SQL error messages in production PHP configuration to reduce information available to attackers during probing.

# Example nginx location rule to block obvious SQLi patterns in access_code
location ~* /reviewer_0/admins/assessments/examproper/btn_functions\.php$ {
    if ($arg_access_code ~* "(\'|\"|--|#|/\*|union|select|sleep\(|benchmark\()") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}