CVE-2026-102910: Online Reviewer Management System SQLI

CVE-2026-102910 Overview

CVE-2026-102910 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The flaw resides in the /reviewer_0/admins/assessments/examproper/exam-delete.php script. Attackers can manipulate the test_id parameter to inject arbitrary SQL statements against the backing database. The issue is remotely exploitable and requires no authentication or user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The weakness is categorized under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL through the test_id parameter of exam-delete.php, exposing or modifying data stored in the application's database.

Affected Products

SourceCodester Online Reviewer Management System 1.0
Component: /reviewer_0/admins/assessments/examproper/exam-delete.php
Vulnerable parameter: test_id

Discovery Timeline

2026-09-30 - CVE-2026-102910 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102910

Vulnerability Analysis

The vulnerability is a first-order SQL injection reachable through an administrative endpoint of the Online Reviewer Management System. The exam-delete.php script accepts a test_id argument and passes it directly into a SQL statement without parameterization or sanitization. Because the endpoint executes over the network and does not enforce authentication controls that block the attack, remote adversaries can trigger the flaw with a single crafted HTTP request. Successful exploitation can lead to disclosure of stored records, tampering with exam data, or destructive statements against the underlying database schema. Additional references are available in the VulDB CVE record and the GitHub CVE issue discussion.

Root Cause

The root cause is the concatenation of untrusted input into a SQL query. The test_id value supplied in the request is embedded in the query string used to delete exam records, without prepared statements or type enforcement. Any input containing SQL metacharacters is interpreted as part of the query.

Attack Vector

Exploitation is performed remotely over HTTP against the vulnerable script. The attacker submits a request to exam-delete.php with a malicious test_id value that includes SQL syntax. No credentials, prior compromise, or user interaction are required. Refer to the VulDB vulnerability details for additional exploitation context.

No verified proof-of-concept code is included. See the linked references for public disclosure details.

Detection Methods for CVE-2026-102910

Indicators of Compromise

HTTP requests to /reviewer_0/admins/assessments/examproper/exam-delete.php containing SQL metacharacters such as single quotes, UNION, SLEEP, or comment sequences (--, #) in the test_id parameter.
Unexpected deletion of exam records or anomalous rows appearing in application tables.
Database error messages referencing the exam-delete.php request path in web server logs.

Detection Strategies

Inspect web access logs for non-numeric test_id values or encoded payloads targeting the delete endpoint.
Enable database query logging and alert on syntactically malformed or unusually long queries originating from the application user.
Deploy web application firewall signatures for common SQL injection payload patterns against administrative PHP endpoints.

Monitoring Recommendations

Correlate authentication events with administrative endpoint hits to identify unauthenticated access attempts.
Baseline the volume of DELETE operations against exam tables and alert on deviations.
Retain HTTP request bodies and query strings for the admins/assessments directory for forensic review.

How to Mitigate CVE-2026-102910

Immediate Actions Required

Restrict network exposure of the Online Reviewer Management System administrative interface to trusted IP ranges or a VPN.
Enforce authentication and session checks in front of /reviewer_0/admins/ before any parameter processing occurs.
Audit database logs and application data for signs of prior exploitation.

Patch Information

No vendor patch has been referenced in the disclosed advisory data. Consult the SourceCodester site for updated releases and monitor the VulDB CVE record for remediation announcements.

Workarounds

Replace dynamic query construction in exam-delete.php with parameterized queries or prepared statements using PDO or mysqli bound parameters.
Cast the test_id parameter to an integer at the earliest point of use and reject non-numeric input.
Apply least-privilege database credentials so the application account cannot perform destructive operations beyond its needs.

bash

# Example: enforce numeric input handling in PHP before query execution
$test_id = filter_input(INPUT_GET, 'test_id', FILTER_VALIDATE_INT);
if ($test_id === false) { http_response_code(400); exit('Invalid test_id'); }
$stmt = $pdo->prepare('DELETE FROM exams WHERE test_id = :id');
$stmt->execute([':id' => $test_id]);