CVE-2026-36920: Janobe Online Reviewer System SQLi Flaw

CVE-2026-36920 Overview

CVE-2026-36920 is a SQL Injection vulnerability affecting Sourcecodester Online Reviewer System v1.0. The vulnerability exists in the file /system/system/admins/assessments/examproper/questions-view.php, allowing authenticated attackers with high privileges to inject malicious SQL queries and potentially extract sensitive information from the underlying database.

Critical Impact

Authenticated attackers with administrative privileges can exploit this SQL Injection flaw to read confidential data from the database, potentially exposing user credentials, examination content, and other sensitive information stored in the Online Reviewer System.

Affected Products

• Janobe Online Reviewer System v1.0
• Applications using Sourcecodester Online Reviewer System codebase

Discovery Timeline

• 2026-04-13 - CVE-2026-36920 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-36920

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) affects the questions-view.php file within the administrative assessment module of the Online Reviewer System. The vulnerability requires network access and high-level privileges to exploit, limiting its attack surface to authenticated administrative users. While exploitation requires elevated privileges, successful attacks can result in unauthorized disclosure of confidential information stored in the application's database.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which occurs when user-supplied input is incorporated into SQL queries without proper sanitization or parameterization. This allows attackers to manipulate query logic and access data beyond their intended authorization scope.

Root Cause

The root cause of this vulnerability is insufficient input validation and improper handling of user-supplied parameters in the questions-view.php file. The application fails to properly sanitize or use parameterized queries when processing input, allowing SQL syntax to be injected directly into database queries. This classic SQL Injection pattern enables attackers to modify the intended query structure.

Attack Vector

The attack vector is network-based, requiring an authenticated session with administrative privileges. An attacker with valid high-privilege credentials can craft malicious requests to the vulnerable endpoint at /system/system/admins/assessments/examproper/questions-view.php. By injecting SQL syntax into vulnerable parameters, the attacker can manipulate database queries to extract sensitive information.

The vulnerability has low complexity to exploit once an attacker has obtained the necessary administrative credentials. The impact is limited to confidentiality, with no direct integrity or availability impact documented. Detailed technical analysis is available in the GitHub SQL Injection Report.

Detection Methods for CVE-2026-36920

Indicators of Compromise

• Unusual SQL error messages in application logs or web server error logs
• Suspicious requests to /system/system/admins/assessments/examproper/questions-view.php containing SQL keywords or special characters
• Database query logs showing anomalous patterns or UNION-based injection attempts
• Unexpected data access patterns from administrative accounts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL Injection patterns in HTTP requests
• Monitor application logs for SQL syntax errors or database exception messages
• Deploy database activity monitoring to identify unusual query patterns or data extraction attempts
• Review access logs for the vulnerable endpoint with parameters containing SQL metacharacters

Monitoring Recommendations

• Enable detailed logging on the web server and application layer for requests to administrative endpoints
• Configure database audit logging to capture all queries executed against sensitive tables
• Set up alerts for multiple failed database queries or SQL syntax errors from single sessions
• Monitor for bulk data retrieval patterns that may indicate successful exploitation

How to Mitigate CVE-2026-36920

Immediate Actions Required

• Restrict access to the administrative interface to trusted IP addresses only
• Review and audit all administrative user accounts and remove unnecessary high-privilege access
• Implement additional authentication controls such as multi-factor authentication for administrative access
• Consider taking the vulnerable endpoint offline until a patch is available

Patch Information

At the time of publication, no official vendor patch has been released for this vulnerability. Organizations should monitor the vendor's official channels for security updates. The vulnerability is documented in the GitHub SQL Injection Report which may contain additional technical details.

Workarounds

• Implement input validation and sanitization at the web server or WAF level for the vulnerable endpoint
• Use prepared statements and parameterized queries by modifying the affected PHP file
• Deploy a reverse proxy with SQL Injection filtering capabilities in front of the application
• Limit database user privileges to minimum required permissions to reduce potential impact

# Example: Apache mod_security rule to block common SQL injection patterns
# Add to your Apache configuration or .htaccess file
SecRule REQUEST_URI "@contains questions-view.php" \
    "id:100001,phase:2,deny,status:403,log,\
    chain"
SecRule ARGS "@detectSQLi" \
    "id:100002,phase:2,deny,status:403,log,\
    msg:'SQL Injection attempt blocked'"