Impact

Successful exploitation allows remote attackers to bypass authentication or extract sensitive data stored within the backend database. This impact is critical for any environment where this system is exposed to the internet. As this is a publicly disclosed vulnerability with exploit code available, organizations should assume that opportunistic scanning and exploitation may occur.

Recommendation

• Immediately restrict public access to the Online Reviewer System login page while evaluating the impact.
• Audit web server logs for suspicious POST requests to login/index.php containing SQL metacharacters (e.g., single quotes, comment delimiters).
• Check for anomalous database query patterns consistent with automated SQL injection tools (e.g., sqlmap).
• Given the lack of a vendor patch for this version, consider migrating to a more secure authentication mechanism or disabling the application until an official security update is provided by SourceCodester.