CVE-2026-93973: SourceCodester Online Reviewer Management System btn_functions.php remove sql injection
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer0/admins/assessments/subject/btnfunctions.php?action=remove. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Online Reviewer Management System btn_functions.phpfrom your environment.Remove the affected file/feature btn_functions.php in SourceCodester Online Reviewer Management System, because a manipulation of the argument ID can result in SQL injection via /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove.
- Compensating control
Restrict network access to the affected endpoint path /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove so only trusted clients can reach it (since the attack can be initiated remotely).
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction according to the supplied vector. Exploitation targets the ID argument in the remove action of the affected endpoint.
Which deployments should be treated as exposed?
Deployments of SourceCodester Online Reviewer Management System 1.0 should be treated as potentially exposed if the referenced admin assessment subject endpoint is reachable by an attacker. The provided data does not establish whether authentication or default access controls restrict that endpoint.
How urgent is remediation?
Prioritize remediation because the issue is rated high severity and public exploit code is reported to exist. Successful SQL injection may affect confidentiality, integrity, and availability, each with low assessed impact.