CVE-2026-95924: Online Reviewer Management System SQLI

CVE-2026-95924 Overview

CVE-2026-95924 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The flaw resides in /reviewer_0/admins/assessments/databank/btn_functions.php when the action=add handler processes the difficulty_id parameter. An unauthenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements against the backing database. The issue is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. Public disclosure has occurred, and exploit details are available through third-party vulnerability databases.

Critical Impact
Remote, unauthenticated attackers can inject SQL through the difficulty_id parameter to read, modify, or delete data in the application's database.

Affected Products

SourceCodester Online Reviewer Management System 1.0
Component: /reviewer_0/admins/assessments/databank/btn_functions.php
Vulnerable parameter: difficulty_id (action=add)

Discovery Timeline

2026-09-23 - CVE-2026-95924 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95924

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the assessment databank handler of the Online Reviewer Management System. When a request is sent to btn_functions.php?action=add, the application concatenates the user-supplied difficulty_id value into a SQL statement without proper sanitization or parameterization. Attackers can supply crafted input that breaks out of the intended query context and executes arbitrary SQL. The attack requires no authentication and no user interaction, and it is reachable over the network. Exploitation can expose stored assessment data, user records, and credentials handled by the application.

Root Cause

The root cause is improper neutralization of special elements passed into a downstream SQL query [CWE-74]. The difficulty_id parameter is trusted as-is and embedded directly into a database statement, bypassing prepared statements or input validation routines that would neutralize SQL metacharacters.

Attack Vector

Exploitation occurs over HTTP against the administrative endpoint /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. An attacker sends a crafted request in which the difficulty_id parameter contains SQL syntax such as boolean predicates, UNION selects, or time-based payloads. The backend executes the injected SQL under the privileges of the application database user. A working exploit has been publicly disclosed, lowering the barrier to opportunistic exploitation. Technical details are documented in the VulDB entry for CVE-2026-95924 and the associated GitHub Issue Discussion.

Detection Methods for CVE-2026-95924

Indicators of Compromise

HTTP requests to /reviewer_0/admins/assessments/databank/btn_functions.php containing action=add and SQL metacharacters (single quotes, UNION, SLEEP(, --, /*) in the difficulty_id parameter.
Unexpected database errors or long response times generated by the btn_functions.php endpoint.
Application or database logs showing malformed queries referencing the difficulty_id field.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the difficulty_id parameter for SQL syntax and block requests containing injection payloads.
Enable verbose SQL error logging in non-production tiers to surface anomalous queries generated by the databank handler.
Correlate access logs for repeated requests to the vulnerable path from the same source IP with varying difficulty_id values, a common pattern for automated SQL injection tooling.

Monitoring Recommendations

Alert on HTTP 500 responses or database exceptions originating from btn_functions.php.
Monitor outbound database traffic for unusual query volumes, information_schema access, or bulk row reads from tables handling user or assessment data.
Track administrative-path access from untrusted networks, since the endpoint is under an /admins/ route yet reachable without authentication.

How to Mitigate CVE-2026-95924

Immediate Actions Required

Restrict network access to the /reviewer_0/admins/ path using IP allowlists, VPN, or reverse-proxy authentication until a patched build is available.
Deploy WAF signatures that block SQL injection payloads targeting the difficulty_id parameter on btn_functions.php.
Audit the application database for signs of tampering, unauthorized reads, or newly created accounts.

Patch Information

At the time of publication, no official vendor patch has been referenced in the CVE record. Administrators should monitor the SourceCodester Security Resources site and the VulDB Vulnerability #408546 entry for updates. Where source is available, remediation requires replacing string concatenation in the btn_functions.phpadd handler with parameterized queries or prepared statements and validating difficulty_id as an integer.

Workarounds

Enforce server-side input validation that casts difficulty_id to an integer before use in any query.
Apply least-privilege database credentials so the application account cannot read from or write to tables outside its functional scope.
Disable or remove the btn_functions.php endpoint if the databank functionality is not required in production deployments.

bash

# Example ModSecurity rule to block SQLi patterns in difficulty_id
SecRule ARGS:difficulty_id "@rx (?i)(union(\s|\+)+select|sleep\s*\(|--|/\*|';)" \
    "id:1029595,phase:2,deny,status:403,log,\
     msg:'CVE-2026-95924 SQLi attempt against btn_functions.php'"