CVE-2026-105246: Online Reviewer Management System SQLi Flaw

CVE-2026-105246 Overview

CVE-2026-105246 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The flaw resides in /reviewer_0/admins/assessments/Subject/btn_functions.php when the action=update endpoint is invoked. Attackers can manipulate the Subject parameter to inject arbitrary SQL statements. The vulnerability is remotely exploitable without authentication and requires no user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact

Unauthenticated remote attackers can inject arbitrary SQL through the Subject parameter, exposing database contents and administrative data in the Online Reviewer Management System.

Affected Products

• SourceCodester Online Reviewer Management System 1.0
• Vulnerable endpoint: /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update
• Vulnerable parameter: Subject

Discovery Timeline

• 2026-10-05 - CVE-2026-105246 published to the National Vulnerability Database (NVD)
• 2026-10-06 - Last updated in the NVD database

Technical Details for CVE-2026-105246

Vulnerability Analysis

The vulnerability is a SQL injection flaw affecting the administrative assessments module of the Online Reviewer Management System. The btn_functions.php script accepts an action=update request and processes the user-supplied Subject parameter without proper sanitization. Attackers can supply crafted input that is concatenated directly into a SQL query. This allows an unauthenticated remote attacker to alter query logic, read arbitrary data, or modify records.

Because the system is a PHP/MySQL web application typically deployed on small institutional servers, exploitation requires only HTTP access to the application. The public disclosure of exploit details lowers the technical barrier for attackers. Successful exploitation can lead to credential theft, unauthorized data modification, and pivoting into further attacks against the hosting environment.

Root Cause

The root cause is improper neutralization of special characters passed to the backend database engine [CWE-74]. The Subject argument is embedded into a SQL statement without prepared statements or parameterized queries. The affected handler does not perform type checking, escaping, or input whitelisting on Subject before executing the update operation.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP request to the vulnerable endpoint with a malicious payload in the Subject parameter. The server processes the injected SQL as part of the update query. Refer to the GitHub issue and VulDB entry for CVE-2026-105246 for additional technical context. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2026-105246

Indicators of Compromise

• HTTP requests to /reviewer_0/admins/assessments/Subject/btn_functions.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or -- in the Subject parameter.
• Unexpected database errors or long response times correlating with requests to the action=update endpoint.
• Web server access logs showing repeated probing of btn_functions.php from a single source address.

Detection Strategies

• Deploy web application firewall (WAF) signatures that inspect query strings and POST bodies for SQL injection patterns targeting the Subject parameter.
• Enable database query logging and alert on anomalous queries originating from the Online Reviewer Management System service account.
• Correlate web request logs with authentication logs to detect unauthenticated access attempts to administrative paths.

Monitoring Recommendations

• Monitor outbound connections from the web server for signs of data exfiltration following suspicious database activity.
• Track creation or modification of database users and privilege grants in the application's MySQL instance.
• Review file integrity on the /reviewer_0/admins/ directory to detect webshell deployment following exploitation.

How to Mitigate CVE-2026-105246

Immediate Actions Required

• Restrict network access to the Online Reviewer Management System administrative interface using IP allowlisting or VPN-only access.
• Review web and database logs for prior exploitation activity against btn_functions.php and rotate any exposed credentials.
• Place the application behind a WAF with SQL injection rules enabled until a vendor patch is applied.

Patch Information

At the time of publication, no official vendor patch has been referenced in the advisory. Monitor the SourceCodester project page and the VulDB vulnerability record #413452 for updated remediation guidance. Administrators should consider taking the application offline if it exposes sensitive data and no fix is available.

Workarounds

• Modify btn_functions.php to use parameterized queries (PDO::prepare with bound parameters or mysqli_prepare) instead of string concatenation.
• Add server-side input validation that rejects non-alphanumeric characters in the Subject parameter where feasible.
• Enforce least-privilege database accounts so that the web application cannot read or modify tables outside its functional scope.

# Example Apache rewrite rule to block the vulnerable endpoint until patched
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/reviewer_0/admins/assessments/Subject/btn_functions\.php$ [NC]
RewriteCond %{QUERY_STRING} action=update [NC]
RewriteRule .* - [F,L]