SQL Injection in SourceCodester Online Reviewer Management System

SourceCodester Online Reviewer Management System version 1.0 contains a critical SQL injection vulnerability identified as CVE-2026-93959. The flaw exists within the 'btn_functions.php' script located in the '/reviewer_0/admins/assessments/course/' directory. An unauthenticated remote attacker can exploit this by sending a crafted HTTP request containing malicious SQL syntax within the 'Course' argument. Successful exploitation allows the attacker to manipulate the underlying database queries, which may lead to unauthorized data exfiltration, modification of database contents, or in some configurations, administrative access. Given that public exploit code is already disclosed, defenders should prioritize patching or restricting access to the affected web directory.

Attack Chain

1. Attacker performs reconnaissance to identify instances of the SourceCodester Online Reviewer Management System.
2. Attacker sends a crafted HTTP GET or POST request to '/reviewer_0/admins/assessments/course/btn_functions.php'.
3. Attacker injects malicious SQL payload into the 'Course' parameter.
4. The web server processes the request and passes the unsanitized input to the database backend.
5. The database executes the injected query, returning unauthorized data or performing requested modifications.
6. Attacker exfiltrates sensitive database content or establishes persistent access via database functions.

Impact

The vulnerability allows unauthenticated remote attackers to compromise the integrity and confidentiality of the database. This can lead to the loss of user credentials, system configuration details, or other sensitive information hosted within the application. Organizations utilizing this software in production environments face a high risk of total database compromise if the application is internet-facing.

Recommendation

• Immediate mitigation: Restrict access to the '/reviewer_0/admins/assessments/course/' directory via web server access controls (e.g., allowlisting IP addresses).
• Detection engineering: Deploy the web server detection rule below to monitor for SQL injection attempts against the identified endpoint.
• Patch management: Monitor the SourceCodester vendor site for an official security update addressing CVE-2026-93959 and apply it to all production instances of the Online Reviewer Management System.