CVE-2026-95926: Online Reviewer Management System SQLi

CVE-2026-95926 Overview

CVE-2026-95926 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The flaw resides in the /reviewer_0/admins/assessments/pretest/btn_functions.php endpoint when invoked with action=update. Attackers can manipulate the test_id parameter to inject arbitrary SQL statements into the underlying database query. The vulnerability is exploitable remotely without authentication or user interaction. Public disclosure of the exploit has already occurred, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Unauthenticated remote attackers can inject SQL through the test_id parameter to read, modify, or delete backend database records in affected deployments.

Affected Products

• SourceCodester Online Reviewer Management System 1.0
• Deployments exposing /reviewer_0/admins/assessments/pretest/btn_functions.php
• Installations relying on the vulnerable action=update handler

Discovery Timeline

• 2026-09-23 - CVE-2026-95926 published to the National Vulnerability Database (NVD)
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95926

Vulnerability Analysis

The vulnerability affects the pretest assessment management functionality of SourceCodester Online Reviewer Management System 1.0. When the application processes an update action against btn_functions.php, it consumes the test_id request parameter and passes it into a SQL query without proper sanitization or parameterization. An attacker supplying crafted input can alter the intended query structure and execute arbitrary SQL against the backend database.

Because the endpoint is reachable over the network and requires no credentials, exploitation attempts can be automated at scale. Public disclosure of the technique through VulDB CVE-2026-95926 and the GitHub Issue Discussion lowers the barrier for attackers to weaponize the flaw.

Root Cause

The root cause is missing input validation and lack of prepared statements around the test_id parameter. The affected PHP handler concatenates untrusted user input directly into a SQL string, allowing metacharacters such as single quotes, comments, and UNION clauses to modify query semantics. This class of defect maps to [CWE-74] and specifically the SQL injection subclass.

Attack Vector

An attacker sends an HTTP request to /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update with a manipulated test_id value. Because the endpoint is exposed over the network and does not require authentication or user interaction, the request can be delivered directly by any client that can reach the application. Successful exploitation can lead to unauthorized data access, data modification, and disruption of assessment records.

// Verified exploit code was not published with this advisory.
// See VulDB CVE-2026-95926 and the referenced GitHub issue for technical details.

Detection Methods for CVE-2026-95926

Indicators of Compromise

• Requests to /reviewer_0/admins/assessments/pretest/btn_functions.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the test_id parameter.
• Web server logs showing repeated action=update requests from a single source with varying test_id payloads.
• Database error messages or unexpected result sets returned from the assessment module.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect query strings for common SQL injection signatures on the vulnerable path.
• Correlate database audit logs with web request logs to identify queries originating from the pretest handler that deviate from expected patterns.
• Instrument the application with query logging to flag statements referencing the test_id column that contain concatenated user input.

Monitoring Recommendations

• Alert on HTTP 500 responses generated by btn_functions.php, which often indicate malformed SQL from injection attempts.
• Monitor outbound connections from the database host for signs of exfiltration following suspicious query activity.
• Track authentication anomalies on administrator accounts, since successful SQL injection can enable credential theft or privilege escalation.

How to Mitigate CVE-2026-95926

Immediate Actions Required

• Restrict network access to the /reviewer_0/admins/ path using IP allowlisting or VPN-only exposure until a patch is available.
• Deploy WAF signatures that block SQL injection payloads targeting the test_id parameter.
• Review database and web server logs for prior exploitation attempts against btn_functions.php.

Patch Information

As of the NVD publication date, no vendor patch has been referenced for CVE-2026-95926. Administrators should monitor the SourceCodester Security Resources page and the VulDB Vulnerability #408548 record for remediation updates.

Workarounds

• Modify the affected PHP handler to use parameterized queries or prepared statements for the test_id value.
• Enforce server-side input validation to accept only numeric identifiers for test_id.
• Apply least-privilege permissions to the database account used by the application to limit the blast radius of a successful injection.

# Example WAF rule concept blocking SQLi patterns on the vulnerable endpoint
# (adapt to your WAF syntax before deployment)
SecRule REQUEST_URI "@contains /reviewer_0/admins/assessments/pretest/btn_functions.php" \
  "chain,deny,status:403,id:1009926,msg:'Block SQLi attempt on test_id (CVE-2026-95926)'"
  SecRule ARGS:test_id "@rx (?i)(union(\s|/\*)+select|sleep\(|--|;|')" "t:none"