SQL Injection in code-projects Online Reviewer System

A SQL injection vulnerability has been identified in the Online Reviewer System version 1.0, developed by code-projects. The flaw exists within the User Update Handler component, specifically in the file '/reviewer/system/system/admins/manage/users/btn_functions.php'. An unauthenticated remote attacker can leverage this vulnerability to manipulate backend database queries through an unknown parameter or function. This allows for unauthorized access to, or modification of, sensitive application data. The vulnerability is considered high-risk due to the existence of publicly available exploit code, increasing the likelihood of opportunistic exploitation against deployments of this software.

Impact

Successful exploitation allows remote attackers to bypass security controls to access or modify the application database. This could result in the exfiltration of user records, administrative account takeover, or the deletion of critical data. Organizations using this software are at significant risk of data compromise if the application remains exposed to the internet.

Recommendation

• Immediately restrict public access to the Online Reviewer System application.
• Audit web server logs for suspicious POST or GET requests targeting '/reviewer/system/system/admins/manage/users/btn_functions.php' containing SQL keywords such as 'UNION', 'SELECT', 'OR 1=1', or comment characters like '--'.
• Given the lack of a vendor patch, evaluate replacing the vulnerable application with a supported alternative.