Overview
A second SQL injection vulnerability has surfaced in SourceCodester's Online Reviewer Management System v1.0, the same free PHP/MySQL exam-management template covered in our CVE-2026-93959 writeup. Tracked as CVE-2026-93973, this flaw lets a remote, unauthenticated attacker inject arbitrary SQL through the ID parameter of /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-93973 |
| Severity | High (CVSS 3.1: 7.3) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| Weakness | CWE-74, CWE-89 (SQL Injection) |
| Vulnerable File | /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove |
| Parameter | ID |
| Authentication | None required |
| Exploit Maturity | Public PoC available |
How It Works
The ID argument passed to the subject module's remove action is concatenated directly into a backend SQL query without parameterization (CWE-89), identical in pattern to the Course parameter bug in CVE-2026-93959. No authentication gate protects the endpoint, so network reachability is the only prerequisite for exploitation.
This is the third confirmed instance of the same injection pattern across the assessments module — the course module (CVE-2026-93959), this subject module (CVE-2026-93973), and the databank module (CVE-2026-93974, published alongside this one) all share the identical btn_functions.php?action=remove → ID parameter flaw. That consistency strongly suggests a shared, unvalidated helper function reused across every btn_functions.php in the codebase rather than three independent bugs.
Impact Assessment
Who Is At Risk
- Any organization or individual running Online Reviewer Management System v1.0 with the admin/assessments module reachable over the network
- As with the course-module flaw, expect exposure concentrated on small schools, training centers, and unmonitored personal deployments
Potential Impact
- Unauthorized read access to the application database, including student records, grades, and admin credentials
- Data tampering or deletion via injected
UPDATE/DELETEstatements against the subject table - Chained exploitation risk: an attacker who automates all three known
btn_functions.phpendpoints gets three independent paths into the same database
Mitigation
- Patch all three known-vulnerable
btn_functions.phpfiles (course,subject,databank) to use parameterized queries — patching only the module in the news headline leaves the others open - Deploy a WAF with SQL injection rules as an interim compensating control across the entire
/admins/assessments/path, not just the affected file - Restrict network exposure of the admin/assessments module to trusted networks only
- Audit database logs for anomalous queries against the
subjecttable going back to disclosure - Given the recurring, systemic nature of this injection pattern, reassess whether this unmaintained template is appropriate for any deployment handling real student or institutional data