CVE-2026-104123: Online Reviewer Management System SQLi

CVE-2026-104123 Overview

CVE-2026-104123 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The flaw resides in the /reviewer_0/admins/assessments/activities/btn_functions.php endpoint when invoked with the action=activity parameter. Attackers manipulate the Title argument to inject arbitrary SQL statements into the backend database query. The weakness falls under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). Remote exploitation requires no authentication, and a public exploit disclosure has been referenced in the VulDB Vulnerability Details record. Administrators and asset owners running this PHP-based reviewer platform should treat the issue as actively discoverable.

Critical Impact
Unauthenticated attackers can inject SQL through the Title parameter to read, modify, or exfiltrate data from the Online Reviewer Management System database.

Affected Products

SourceCodester Online Reviewer Management System 1.0
btn_functions.php script within the /reviewer_0/admins/assessments/activities/ path
Any deployment exposing the vulnerable endpoint to untrusted networks

Discovery Timeline

2026-10-02 - CVE-2026-104123 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104123

Vulnerability Analysis

The vulnerability exists in the activity management workflow of the Online Reviewer Management System. The script btn_functions.php processes a Title parameter when the action query argument equals activity. User-supplied input flows into a SQL statement without proper neutralization, enabling classic in-band SQL injection. Because the endpoint is reachable over the network and requires no credentials, attackers can target it directly from the internet when the application is externally exposed. According to the VulDB CVE Record, the exploit is public, which lowers the skill barrier for opportunistic actors scanning for vulnerable PHP applications.

Root Cause

The root cause is improper neutralization of special elements passed into a downstream SQL interpreter, consistent with [CWE-74]. The Title input is concatenated into or interpolated within a SQL query rather than being bound through a parameterized statement. Without input validation, type casting, or prepared statements, metacharacters such as single quotes and SQL keywords alter the intended query logic.

Attack Vector

An attacker crafts an HTTP request to /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity and supplies a malicious value for the Title parameter. The injected payload executes within the database context used by the application. Depending on database privileges, outcomes include data disclosure, unauthorized modification of assessment records, authentication tampering, or secondary payload staging. See the GitHub Issue Discussion and VulDB CTI Information for additional technical context.

No verified exploit code is reproduced here. Refer to the public references for proof-of-concept details.

Detection Methods for CVE-2026-104123

Indicators of Compromise

HTTP requests to /reviewer_0/admins/assessments/activities/btn_functions.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the Title parameter.
Web server access logs showing unusually long Title values, URL-encoded SQL syntax, or repeated probing with incrementing payloads.
Database error messages or stack traces returned in HTTP responses from the btn_functions.php endpoint.
Unexpected changes to assessment, activity, or administrator records within the Online Reviewer Management System database.

Detection Strategies

Deploy signatures in web application firewalls that flag SQL injection patterns targeting the action=activity endpoint.
Correlate HTTP 500 responses from btn_functions.php with inbound requests containing suspicious Title values.
Hunt in database audit logs for queries referencing the Title column that include boolean tautologies or time-based delay functions.

Monitoring Recommendations

Forward web server, PHP error, and MySQL general query logs to a centralized analytics platform for retention and correlation.
Alert on authentication anomalies, privilege changes, and bulk data reads originating from the application service account.
Establish a baseline of normal btn_functions.php traffic volume and alert on sustained spikes consistent with automated scanning.

How to Mitigate CVE-2026-104123

Immediate Actions Required

Restrict external access to the /reviewer_0/admins/ administrative paths using network ACLs, VPN, or IP allow-lists.
Deploy a web application firewall rule that blocks SQL metacharacters and known injection payloads in the Title parameter.
Review web and database logs for prior exploitation attempts targeting btn_functions.php?action=activity.
Rotate database credentials and administrative passwords if evidence of compromise is identified.

Patch Information

At the time of publication, no vendor-supplied patch has been referenced in the NVD entry or the SourceCodester Code Repository. Organizations should monitor the vendor site and the VulDB CVE Record for fix availability. Until a patch is released, apply code-level remediation by converting all affected SQL statements to use prepared statements with bound parameters and by validating Title against an allow-list of permitted characters.

Workarounds

Place the application behind a reverse proxy that enforces strict input validation on all query parameters.
Enforce least-privilege database accounts so the application cannot execute DDL statements or access unrelated schemas.
Disable or remove the btn_functions.php endpoint if the activity management feature is not required in your deployment.
Enable PHP and database error suppression in production to limit information leakage to attackers probing the endpoint.

bash

# Example WAF rule concept (ModSecurity) blocking SQLi in the Title parameter
SecRule REQUEST_URI "@contains /reviewer_0/admins/assessments/activities/btn_functions.php" \
  "id:1041230,phase:2,deny,status:403,\
   chain,msg:'Potential SQLi against CVE-2026-104123'"
  SecRule ARGS:Title "@detectSQLi" "t:none,t:urlDecodeUni"