CVE-2026-105247: SourceCodester Online Reviewer Management System btn_functions.php course sql injection
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer0/admins/assessments/Subject/btnfunctions.php?action=course. Executing a manipulation of the argument Subject can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is remotely exploitable and the supplied severity vector indicates no privileges or user interaction are required. An attacker can target the affected endpoint by manipulating the Subject argument.
Which deployment is known to be affected?
The reported affected product is SourceCodester Online Reviewer Management System version 1.0. The vulnerable functionality is associated with /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course.
How can I determine whether my installation may be exposed?
Check whether the application includes the specified btn_functions.php endpoint and uses the action=course path with a Subject parameter. Systems running the identified 1.0 version should be treated as potentially affected.
Is exploitation likely to be practical?
The vulnerability has a low attack-complexity rating, and a public exploit has been disclosed. The provided assessment rates exploit maturity as proof-of-concept.