CVE-2026-109620: SourceCodester Online Reviewer System index.php prepare sql injection
A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
SourceCodester Online Reviewer System version 1.0 is affected. The vulnerable code is in login/index.php, and the attack can be launched remotely without authentication or user interaction.
What input does an attacker need to control?
The issue is triggered by manipulation of the username or password argument passed to PDO::prepare. This indicates the login path is the relevant attack surface.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.