CVE-2026-105247: Online Reviewer Management System SQL Injection

CVE-2026-105247 Overview

CVE-2026-105247 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The flaw resides in /reviewer_0/admins/assessments/Subject/btn_functions.php when the action=course parameter is invoked. Attackers can manipulate the Subject argument to inject arbitrary SQL into backend database queries. The vulnerability is remotely exploitable without authentication and requires no user interaction. Public disclosure of the exploit technique has occurred, increasing the likelihood of opportunistic abuse against exposed deployments. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Unauthenticated attackers can inject SQL statements through the Subject parameter to read, modify, or delete database contents of the Online Reviewer Management System.

Affected Products

• SourceCodester Online Reviewer Management System 1.0
• Deployments exposing /reviewer_0/admins/assessments/Subject/btn_functions.php
• Any downstream fork reusing the vulnerable btn_functions.php handler

Discovery Timeline

• 2026-10-05 - CVE-2026-105247 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105247

Vulnerability Analysis

The vulnerability stems from unsanitized handling of the Subject HTTP parameter inside btn_functions.php. When the application receives a request with action=course, the handler incorporates the attacker-supplied value directly into a SQL query. No parameterization or input validation separates user input from the query structure. Remote attackers can submit crafted requests to extract records, bypass authentication logic, or modify data stored by the application. Because the Online Reviewer Management System is a PHP application typically deployed with MySQL, standard union-based and boolean-based injection techniques apply.

Root Cause

The root cause is improper neutralization of special characters in SQL statements [CWE-74]. The btn_functions.php script concatenates the Subject parameter into a query string without using prepared statements or escaping routines such as mysqli_real_escape_string. Any single-quote or SQL metacharacter in the input terminates the intended query context and begins attacker-controlled SQL execution.

Attack Vector

Exploitation requires only HTTP access to the vulnerable endpoint. An attacker sends a request such as GET /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course&Subject=<payload> with SQL syntax in the Subject parameter. No credentials, tokens, or prior session establishment are required. The attack surface expands when the application is published to the internet without a web application firewall.

See the GitHub Issue Discussion and VulDB CVE-2026-105247 entry for additional technical context.

Detection Methods for CVE-2026-105247

Indicators of Compromise

• HTTP requests to /reviewer_0/admins/assessments/Subject/btn_functions.php containing SQL metacharacters such as ', UNION, SELECT, SLEEP(, or -- in the Subject parameter.
• Database error messages referencing btn_functions.php in web server logs.
• Unexpected database read volume or anomalous information_schema queries originating from the application service account.

Detection Strategies

• Deploy web application firewall signatures that match SQL injection patterns in the Subject query parameter.
• Enable database query logging and alert on unparameterized dynamic SQL involving user-facing identifiers.
• Correlate HTTP access logs with authentication events to flag unauthenticated requests touching admin paths such as /reviewer_0/admins/.

Monitoring Recommendations

• Monitor outbound HTTP responses for unusually large payload sizes that may indicate data exfiltration through SQL injection.
• Track repeated 500-series responses from btn_functions.php, which often precede successful injection as attackers probe the endpoint.
• Alert on new administrative accounts or privilege changes within the Online Reviewer Management System database.

How to Mitigate CVE-2026-105247

Immediate Actions Required

• Restrict external access to /reviewer_0/admins/ paths using network ACLs or reverse-proxy authentication until a vendor fix is validated.
• Deploy WAF rules that block SQL metacharacters in the Subject parameter on the btn_functions.php endpoint.
• Audit the application database for unauthorized rows, modified reviewer records, or added administrator accounts.

Patch Information

No vendor patch is referenced in the published advisory data. Operators should monitor SourceCodester for an updated release and review the VulDB vulnerability record for mitigation updates. In the interim, replace vulnerable concatenated queries in btn_functions.php with prepared statements using mysqli or PDO parameter binding.

Workarounds

• Place the application behind an authenticating reverse proxy to prevent unauthenticated access to administrative endpoints.
• Apply server-side input validation that enforces an allowlist for the Subject parameter (for example, numeric IDs only).
• Disable or remove the btn_functions.php endpoint if the action=course function is not required in production.

# Example ModSecurity rule blocking SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /reviewer_0/admins/assessments/Subject/btn_functions.php" \
    "id:1052470,phase:2,deny,status:403,msg:'CVE-2026-105247 SQLi attempt',\
     chain"
    SecRule ARGS:Subject "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\(|--|';)" \
        "t:none,t:urlDecodeUni"