{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asourcecodesteronline_reviewer_system1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sourcecodester:online_reviewer_system:1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-109620"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Online Reviewer System (1.0)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","sql-injection","remote-execution"],"_cs_type":"advisory","_cs_vendors":["SourceCodester"],"content_html":"\u003cp\u003eSourceCodester Online Reviewer System 1.0 is vulnerable to SQL injection (CVE-2026-109620) within the login/index.php file. The vulnerability originates from improper neutralization of special elements used in an SQL command within the PDO::prepare function. An unauthenticated remote attacker can supply malicious input via the username or password fields to manipulate the backend SQL query execution. This vulnerability has been publicly disclosed, and exploit code is available, increasing the risk of unauthorized database access, credential harvesting, or administrative account takeover for organizations hosting this application.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote attackers to bypass authentication or extract sensitive data stored within the backend database. This impact is critical for any environment where this system is exposed to the internet. As this is a publicly disclosed vulnerability with exploit code available, organizations should assume that opportunistic scanning and exploitation may occur.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately restrict public access to the Online Reviewer System login page while evaluating the impact.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for suspicious POST requests to login/index.php containing SQL metacharacters (e.g., single quotes, comment delimiters).\u003c/li\u003e\n\u003cli\u003eCheck for anomalous database query patterns consistent with automated SQL injection tools (e.g., sqlmap).\u003c/li\u003e\n\u003cli\u003eGiven the lack of a vendor patch for this version, consider migrating to a more secure authentication mechanism or disabling the application until an official security update is provided by SourceCodester.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T18:37:04Z","date_published":"2026-10-13T18:37:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-online-reviewer-sql-injection/","summary":"A remote SQL injection vulnerability in SourceCodester Online Reviewer System 1.0 allows attackers to execute arbitrary SQL commands via the login endpoint.","title":"SQL Injection in SourceCodester Online Reviewer System","url":"https://feed.craftedsignal.io/briefs/2026-10-online-reviewer-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:sourcecodester:online_reviewer_system:1.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}