CVE-2026-95927: Online Reviewer Management System SQLI

CVE-2026-95927 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0 affecting the exam-delete.php file. Attackers can exploit the test_id parameter remotely to manipulate database queries. This article covers technical details, affected versions, security impact, and recommended mitigation strategies.

CVE-2026-95927 Overview

CVE-2026-95927 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The flaw resides in the /reviewer_0/admins/assessments/pretest/exam-delete.php script, where the test_id parameter is passed directly to a database query without sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements. Public exploit details are available, lowering the barrier to exploitation. The vulnerability is tracked under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Unauthenticated remote attackers can inject SQL commands through the test_id parameter, potentially exposing or modifying data in the underlying database.

Affected Products

SourceCodester Online Reviewer Management System 1.0
Component: /reviewer_0/admins/assessments/pretest/exam-delete.php
Parameter: test_id

Discovery Timeline

2026-09-23 - CVE-2026-95927 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95927

Vulnerability Analysis

The vulnerability affects the pretest exam deletion workflow inside the administrative area of Online Reviewer Management System 1.0. When an administrator (or any remote party reaching the endpoint) invokes exam-delete.php, the application takes the test_id request argument and concatenates it into a SQL statement. Because the parameter is neither type-checked nor parameterized, attacker-controlled input is interpreted as SQL syntax.

Exploitation requires only network access to the vulnerable PHP endpoint. No user interaction is required, and the attack complexity is low. A public exploit disclosure exists on the GitHub CVE Issue Discussion, and additional context is documented in the VulDB CVE-2026-95927 Details.

Root Cause

The root cause is improper neutralization of special elements in a database query [CWE-74]. The exam-delete.php handler concatenates the test_id HTTP parameter directly into a SQL DELETE (or related) statement without using prepared statements or an allow-list of numeric input. This design pattern allows appended clauses, UNION selects, or boolean-based expressions to alter query semantics.

Attack Vector

Attack traffic is network-based and unauthenticated. An attacker sends a crafted HTTP request to /reviewer_0/admins/assessments/pretest/exam-delete.php with a malicious test_id value. Typical payloads include boolean tautologies, stacked queries, or UNION-based selectors used to extract data from adjacent tables. Because access controls on the admin path do not effectively gate the endpoint, exploitation can proceed remotely without valid credentials.

No verified proof-of-concept code is republished here. Refer to the VulDB Vulnerability Overview #408549 for indexed technical details.

Detection Methods for CVE-2026-95927

Indicators of Compromise

HTTP requests targeting /reviewer_0/admins/assessments/pretest/exam-delete.php containing SQL metacharacters such as ', --, ;, UNION, or SLEEP( in the test_id parameter.
Web server access logs showing repeated GET or POST requests to exam-delete.php with non-numeric test_id values.
Database error messages surfaced in HTTP responses referencing MySQL syntax or unexpected column counts.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the test_id parameter and block payloads containing SQL keywords or comment sequences.
Enable database query logging and alert on DELETE statements with unusually long or malformed WHERE clauses originating from the reviewer application.
Correlate web access logs with database audit logs to identify request-to-query patterns that deviate from expected numeric test_id values.

Monitoring Recommendations

Monitor for outbound data spikes from the database host that could indicate large-scale exfiltration through UNION-based extraction.
Track authentication failures and administrative endpoint hits from unfamiliar source IP addresses.
Alert on any modifications to files under the /reviewer_0/admins/ directory, which may indicate follow-on webshell deployment.

How to Mitigate CVE-2026-95927

Immediate Actions Required

Restrict network access to /reviewer_0/admins/ paths using IP allow-lists or VPN gating until a patch is applied.
Apply WAF signatures to block SQL injection payloads targeting the test_id parameter on exam-delete.php.
Audit database accounts used by the application and remove unnecessary privileges such as FILE, DROP, or cross-schema access.

Patch Information

No vendor patch has been published for SourceCodester Online Reviewer Management System 1.0 at the time of NVD publication (2026-09-23). Monitor the SourceCodester Security Resources page and the VulDB CVE-2026-95927 Details entry for updates. Administrators should treat the application as end-of-support and consider replacement or in-house remediation of the vulnerable query.

Workarounds

Modify exam-delete.php to cast test_id to an integer using intval() before use, or refactor the query to use PDO prepared statements with bound parameters.
Enforce server-side input validation that rejects any non-numeric test_id values before they reach the database layer.
Disable or remove the pretest management module if it is not required in the deployment.

bash

# Example hardening: enforce numeric test_id at the web server layer (Apache mod_rewrite)
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/reviewer_0/admins/assessments/pretest/exam-delete\.php$
RewriteCond %{QUERY_STRING} (^|&)test_id=([^0-9&][^&]*) [NC]
RewriteRule ^ - [F,L]