{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/online-reviewer-system-1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:code-projects:online_reviewer_system:1.0:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Online Reviewer System (1.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","sqli","sql-injection","vulnerability"],"_cs_type":"advisory","_cs_vendors":["code-projects"],"content_html":"\u003cp\u003eA SQL injection vulnerability has been identified in the Online Reviewer System version 1.0, developed by code-projects. The flaw exists within the User Update Handler component, specifically in the file '/reviewer/system/system/admins/manage/users/btn_functions.php'. An unauthenticated remote attacker can leverage this vulnerability to manipulate backend database queries through an unknown parameter or function. This allows for unauthorized access to, or modification of, sensitive application data. The vulnerability is considered high-risk due to the existence of publicly available exploit code, increasing the likelihood of opportunistic exploitation against deployments of this software.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote attackers to bypass security controls to access or modify the application database. This could result in the exfiltration of user records, administrative account takeover, or the deletion of critical data. Organizations using this software are at significant risk of data compromise if the application remains exposed to the internet.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately restrict public access to the Online Reviewer System application.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for suspicious POST or GET requests targeting '/reviewer/system/system/admins/manage/users/btn_functions.php' containing SQL keywords such as 'UNION', 'SELECT', 'OR 1=1', or comment characters like '--'.\u003c/li\u003e\n\u003cli\u003eGiven the lack of a vendor patch, evaluate replacing the vulnerable application with a supported alternative.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T02:31:57Z","date_published":"2026-10-13T02:31:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-online-reviewer-sql-injection/","summary":"The code-projects Online Reviewer System 1.0 contains a remote SQL injection vulnerability in the User Update Handler, with a public exploit currently available.","title":"SQL Injection in code-projects Online Reviewer System","url":"https://feed.craftedsignal.io/briefs/2026-10-online-reviewer-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Online Reviewer System (1.0)","version":"https://jsonfeed.org/version/1.1"}