SQL Injection in SourceCodester Online Reviewer Management System

A SQL injection vulnerability has been identified in SourceCodester Online Reviewer Management System version 1.0. The vulnerability resides within the file /reviewer_0/admins/assessments/examproper/questions-view.php. An attacker can perform remote exploitation by manipulating the ID parameter passed to this script. Successful exploitation allows for the execution of arbitrary SQL commands against the backend database, potentially leading to unauthorized data exfiltration, modification, or administrative access to the underlying management system. Given that the exploit has been publicly disclosed, organizations utilizing this software are at an elevated risk of automated or targeted exploitation attempts.

Impact

Successful exploitation of CVE-2026-102908 permits an unauthenticated remote attacker to compromise the integrity and confidentiality of the application database. Potential impacts include the dumping of sensitive reviewer or exam information, modification of administrative credentials, or full takeover of the application instance.

Recommendation

• Monitor web server access logs for anomalous GET or POST requests directed at /reviewer_0/admins/assessments/examproper/questions-view.php containing SQL syntax characters (e.g., apostrophes, double-dashes, keywords like UNION or SELECT).
• Apply input validation and parameterized queries to the ID parameter in the affected PHP script.
• Implement a Web Application Firewall (WAF) to block requests containing common SQL injection patterns targeting the identified endpoint.