CVE-2026-108956: code-projects Online Reviewer System User Update btn_functions.php sql injection
A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of code-projects Online Reviewer System 1.0 are affected. Because the vulnerable User Update Handler can be reached remotely and requires no privileges or user interaction, internet-accessible instances are the most directly exposed.
What does an attacker need to exploit it?
An attacker can launch the attack remotely with low complexity. No authentication or user interaction is required, and public exploit material is available.
What is known about the affected request parameter or SQL injection technique?
The available data identifies /reviewer/system/system/admins/manage/users/btn_functions.php in the User Update Handler, but does not identify the specific input parameter, HTTP method, or injection technique.
How can I determine whether my deployment is affected?
Confirm whether you operate code-projects Online Reviewer System version 1.0 and whether the identified btn_functions.php path is present. The provided data does not include detection indicators, logs, or a specific malicious request pattern.