CVE-2026-93974: Online Reviewer Management System SQLI

CVE-2026-93974 Overview

CVE-2026-93974 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The flaw resides in the /reviewer_0/admins/assessments/databank/btn_functions.php script when invoked with the action=remove parameter. Attackers can manipulate the ID argument to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely without authentication or user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the application database, potentially exposing, modifying, or deleting stored assessment and user records.

Affected Products

SourceCodester Online Reviewer Management System 1.0
The vulnerable component is btn_functions.php under /reviewer_0/admins/assessments/databank/
No official vendor patch or fixed version is listed in the advisory data

Discovery Timeline

2026-09-20 - CVE-2026-93974 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93974

Vulnerability Analysis

The flaw exists in the administrative databank management workflow of the Online Reviewer Management System. When an administrator (or an attacker reaching the endpoint) issues a request such as btn_functions.php?action=remove&ID=<value>, the application passes the supplied ID value directly into a SQL statement. Because the input is neither parameterized nor properly escaped, an attacker can append additional SQL syntax to alter the query logic.

Successful exploitation allows extraction of database contents, modification of assessment records, or deletion of arbitrary rows. Since the attack executes over the network without authentication, any internet-exposed instance is at risk. The published proof of concept lowers the barrier to exploitation for low-skilled attackers.

Root Cause

The root cause is improper neutralization of user-controlled input inserted into a SQL query [CWE-74]. The remove action handler concatenates the ID request parameter into a DELETE or SELECT statement without using prepared statements, bound parameters, or type coercion. This anti-pattern is common in PHP applications that use direct string interpolation with mysqli_query or similar functions.

Attack Vector

Exploitation requires only network access to the vulnerable endpoint. An attacker sends an HTTP request to /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove with a malicious ID value containing SQL metacharacters. Because the endpoint does not enforce authentication or authorization checks that block the injection, the crafted payload reaches the database engine and executes. Refer to the VulDB Vulnerability Details and the GitHub Issue Discussion for the published proof of concept.

No verified exploit code is reproduced here; consult the linked references for the disclosed request format.

Detection Methods for CVE-2026-93974

Indicators of Compromise

HTTP requests to /reviewer_0/admins/assessments/databank/btn_functions.php containing action=remove combined with SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the ID parameter.
Web server access logs showing anomalous or encoded ID values from unfamiliar source IP addresses.
Database error messages or MySQL warnings correlated with requests to the vulnerable endpoint.
Unexpected deletions or modifications of rows in assessment or databank tables.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the ID query parameter on the affected path and blocks SQL injection signatures.
Enable database query logging and alert on queries originating from the application that contain tautologies such as OR 1=1 or stacked statements.
Correlate HTTP 500 responses from btn_functions.php with subsequent database anomalies.

Monitoring Recommendations

Forward web server and database logs to a centralized analytics platform for correlation and long-term retention.
Monitor for spikes in requests to admin-scoped PHP endpoints from non-administrator source addresses.
Establish baseline traffic patterns for the /reviewer_0/admins/ path and alert on deviations.

How to Mitigate CVE-2026-93974

Immediate Actions Required

Restrict network access to the /reviewer_0/admins/ path using IP allow-listing, VPN gating, or reverse-proxy authentication.
Take internet-facing instances of Online Reviewer Management System 1.0 offline until a vendor fix is available or manual code remediation is applied.
Audit database logs for evidence of exploitation attempts against btn_functions.php.
Rotate any credentials, tokens, or secrets stored in the application database if compromise is suspected.

Patch Information

At the time of publication, no official patch from SourceCodester is referenced in the advisory data for CVE-2026-93974. Administrators should monitor the SourceCodester Resource Hub and the VulDB CVE Report for updates. In the absence of a vendor fix, apply manual source-level remediation by replacing dynamic SQL concatenation with prepared statements using mysqli or PDO bound parameters, and enforce integer type casting on the ID parameter.

Workarounds

Modify btn_functions.php to cast the ID parameter to an integer using (int)$_GET['ID'] before use in any SQL statement.
Refactor the affected query to use parameterized statements such as PDO::prepare with bound parameters.
Add a WAF rule that rejects requests to the vulnerable path when the ID parameter contains non-numeric characters.
Enforce authentication and role-based access controls on all /admins/ endpoints at the web server or reverse proxy layer.

bash

# Example nginx location block restricting admin path access by source IP
location ~ ^/reviewer_0/admins/ {
    allow 10.0.0.0/8;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}