CVE-2026-93959: Online Reviewer Management System SQLi Flaw

CVE-2026-93959 Overview

CVE-2026-93959 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The flaw resides in /reviewer_0/admins/assessments/course/btn_functions.php and stems from unsafe handling of the Course request parameter. An unauthenticated remote attacker can inject arbitrary SQL statements through this parameter to read, modify, or delete database contents. The exploit has been publicly disclosed, increasing the likelihood of opportunistic scanning and abuse against exposed installations.

Critical Impact
Unauthenticated remote attackers can manipulate the Course parameter to execute arbitrary SQL against the backend database, leading to disclosure or tampering of assessment and user data.

Affected Products

SourceCodester Online Reviewer Management System 1.0
Deployments exposing /reviewer_0/admins/assessments/course/btn_functions.php
Downstream forks or customizations reusing the vulnerable btn_functions.php handler

Discovery Timeline

2026-09-20 - CVE-2026-93959 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93959

Vulnerability Analysis

The issue is classified under CWE-74, Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). The vulnerable endpoint btn_functions.php accepts a Course argument from the HTTP request and passes it into a SQL query without proper parameterization or sanitization. Because the endpoint is reachable over the network and does not require authentication or user interaction, attackers can automate discovery and exploitation. Successful exploitation can expose stored credentials, exam content, and reviewer submissions, and can enable modification of assessment records.

Root Cause

The root cause is direct concatenation of user-controlled input into a SQL statement inside btn_functions.php. The application does not use prepared statements or an allow-list for the Course parameter. Any special SQL metacharacters supplied by the client become part of the executed query.

Attack Vector

Exploitation occurs over the network by issuing a crafted HTTP request that sets the Course parameter to a SQL payload. No credentials are needed. Public disclosure of the flaw, referenced in the GitHub CVE Issue Discussion and VulDB CVE-2026-93959 Details, lowers the barrier to weaponization.

No verified proof-of-concept code is reproduced here. Consult the VulDB Vulnerability #407918 entry for technical indicators associated with the disclosure.

Detection Methods for CVE-2026-93959

Indicators of Compromise

HTTP requests to /reviewer_0/admins/assessments/course/btn_functions.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in the Course parameter.
Web server or database logs showing malformed SQL errors originating from btn_functions.php.
Unexpected reads of sensitive tables (users, credentials, assessments) correlated with requests to the vulnerable endpoint.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the Course parameter for SQL injection patterns.
Enable database query logging and alert on queries referencing assessment tables that contain tautologies such as OR 1=1 or stacked statements.
Correlate spikes in HTTP 500 errors from btn_functions.php with source IP reputation feeds.

Monitoring Recommendations

Baseline normal request volume to /reviewer_0/admins/ and alert on anomalies from external sources.
Forward web, application, and MySQL logs to a centralized analytics platform for cross-source correlation.
Track outbound data volume from the database host to detect bulk extraction following successful injection.

How to Mitigate CVE-2026-93959

Immediate Actions Required

Restrict network exposure of the administrative path /reviewer_0/admins/ to trusted IP ranges or place it behind a VPN.
Deploy WAF rules that block SQL injection payloads targeting the Course parameter.
Rotate database credentials and audit assessment records for unauthorized modification if the endpoint has been publicly exposed.

Patch Information

No official vendor patch is referenced in the CVE record at publication. Administrators should monitor SourceCodester Security Resources for updates and, in the interim, apply source-level fixes by replacing dynamic SQL in btn_functions.php with parameterized queries using PDO or mysqli prepared statements. Input validation should enforce an allow-list of expected Course values.

Workarounds

Disable or remove btn_functions.php if the affected feature is not required.
Enforce authentication and role checks on all files under /reviewer_0/admins/ at the web server layer.
Configure the database account used by the application with least-privilege permissions, denying DROP, ALTER, and cross-database access.

bash

# Example Apache configuration to restrict admin path by source IP
<Location "/reviewer_0/admins/">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>