CVE-2026-93973: Online Reviewer Management System SQLi Flaw

CVE-2026-93973 Overview

CVE-2026-93973 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The flaw resides in the /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove endpoint. Attackers can manipulate the ID parameter to inject arbitrary SQL statements against the backing database. The issue is exploitable remotely, requires no authentication, and no user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic scanning and abuse against exposed installations. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Unauthenticated remote attackers can read, modify, or delete assessment and reviewer data by injecting SQL through the ID parameter of the btn_functions.php remove action.

Affected Products

SourceCodester Online Reviewer Management System 1.0
Deployments exposing /reviewer_0/admins/assessments/subject/btn_functions.php
Downstream forks or customizations reusing the vulnerable btn_functions.php handler

Discovery Timeline

2026-09-20 - CVE-2026-93973 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-93973

Vulnerability Analysis

The vulnerable endpoint handles administrative removal of assessment subjects. When a request supplies the ID parameter with action=remove, the value is concatenated directly into a SQL statement without parameterization or input validation. An attacker can append conditional expressions, UNION SELECT payloads, or stacked queries to extract or manipulate arbitrary tables. Because the endpoint sits under the /admins/ path but lacks enforced authentication for the injection sink, the network-exposed script can be reached and abused remotely. Successful exploitation exposes credentials, reviewer records, and assessment results stored in the application database. The EPSS probability sits near 0.43%, but public disclosure combined with trivial exploitation raises real-world risk for internet-facing instances.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a downstream SQL interpreter [CWE-74]. The ID argument is embedded into a query string without prepared statements, parameter binding, or type coercion, allowing SQL metacharacters to alter query semantics.

Attack Vector

The attack vector is network-based (HTTP). An attacker crafts a GET or POST request to btn_functions.php?action=remove with a malicious ID payload. No authentication or user interaction is required to trigger the injection path against a reachable installation.

Example request pattern (conceptual):
GET /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove&ID=<injected SQL> HTTP/1.1

No verified proof-of-concept code is reproduced here. See the GitHub issue and VulDB references for public technical details.

Detection Methods for CVE-2026-93973

Indicators of Compromise

Web server logs showing requests to /reviewer_0/admins/assessments/subject/btn_functions.php with action=remove and unusual ID values containing SQL keywords such as UNION, SELECT, SLEEP, or comment sequences like -- and /*.
Database error messages or unexpected HTTP 500 responses correlated with requests to the vulnerable endpoint.
Unexpected DELETE or UPDATE operations against assessment-related tables from the application service account.
Outbound connections from the web server host immediately following anomalous requests to btn_functions.php.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the ID query parameter for SQL metacharacters and known injection patterns.
Enable database query logging and alert on queries against reviewer or assessment tables that contain concatenated boolean tautologies (for example OR 1=1).
Correlate authentication logs with requests to /admins/ paths to identify unauthenticated access to administrative endpoints.
Baseline normal ID parameter values as short integers and flag non-numeric or oversized inputs.

Monitoring Recommendations

Forward web server and PHP error logs to a centralized analytics platform for retention and correlation.
Monitor for repeated 200 responses to btn_functions.php from a single source, which may indicate blind SQL injection extraction.
Track database user privilege changes and new user creation events tied to the application service account.

How to Mitigate CVE-2026-93973

Immediate Actions Required

Restrict network access to the Online Reviewer Management System administrative paths using IP allowlists or VPN gating.
Remove or rename the /reviewer_0/admins/assessments/subject/btn_functions.php endpoint if the remove functionality is not required.
Enforce authentication and session validation on every administrative script under /admins/ before any database interaction.
Audit the application database for signs of tampering, exfiltration, or unauthorized rows in assessment tables.

Patch Information

No official vendor patch has been published for SourceCodester Online Reviewer Management System 1.0 at the time of NVD publication. Operators should track vendor updates at the SourceCodester project site and the VulDB CVE-2026-93973 entry for remediation guidance. In the absence of a vendor fix, apply source-level mitigations by rewriting the vulnerable query to use parameterized statements.

Workarounds

Replace string concatenation in btn_functions.php with prepared statements using PDO or mysqli bound parameters.
Cast the ID parameter to an integer using intval() before it reaches the SQL query if the field is numeric.
Place the application behind a WAF configured to block SQL injection patterns targeting the ID parameter.
Run the database account used by the application with least privilege, removing DROP, ALTER, and FILE permissions.

bash

# Configuration example: block requests with SQL metacharacters in the ID parameter
# Example ModSecurity rule (illustrative)
SecRule ARGS:ID "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\(|benchmark\(|--|;)" \
  "id:1009301,phase:2,deny,status:403,msg:'Potential SQLi against btn_functions.php ID parameter'"