CVE-2026-93974: SourceCodester Online Reviewer Management System btn_functions.php remove sql injection
A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer0/admins/assessments/databank/btnfunctions.php?action=remove. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block remote access to /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove (e.g., restrict by firewall/WAF to only trusted IPs) to mitigate remotely exploitable SQL injection until patched.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. An attacker manipulates the ID argument in requests to the affected remove action.
Is there public exploit information available?
Yes. An exploit has been published and may be used, which increases the likelihood of exploitation attempts.
Which deployments should be prioritized for investigation?
Prioritize instances of SourceCodester Online Reviewer Management System 1.0 that expose the affected admin assessment databank remove endpoint to remote users. The affected path is /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove.