Overview
A third SQL injection vulnerability has been disclosed in SourceCodester's Online Reviewer Management System v1.0, following the same pattern reported in CVE-2026-93959 and CVE-2026-93973. Tracked as CVE-2026-93974, this flaw lets a remote, unauthenticated attacker inject arbitrary SQL through the ID parameter of /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-93974 |
| Severity | High (CVSS 3.1: 7.3) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| Weakness | CWE-74, CWE-89 (SQL Injection) |
| Vulnerable File | /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove |
| Parameter | ID |
| Authentication | None required |
| Exploit Maturity | Public PoC available |
How It Works
As with its course and subject module siblings, the databank module's remove action concatenates the ID parameter directly into a backend SQL query with no parameterization or sanitization (CWE-89). No authentication is required to reach the endpoint.
This is now the fourth publicly disclosed CVE against the identical btn_functions.php?action=remove → ID injection pattern in this product (CVE-2026-93959, -93972, -93973, -93974), all reported within days of each other. At this point the pattern should be treated as a systemic flaw in a shared, unvalidated query-building helper used across every assessments submodule, not a series of isolated bugs.
Impact Assessment
Who Is At Risk
- Any organization or individual running Online Reviewer Management System v1.0 with the admin/assessments module reachable over the network
- Deployments that already patched the course or subject module in isolation remain fully exposed via this databank endpoint
Potential Impact
- Unauthorized read access to the databank table and, by extension, the shared application database (student records, grades, admin credentials)
- Data tampering or deletion via injected
UPDATE/DELETEstatements - With four independent injection points now confirmed in the same codebase, automated scanners targeting this product family should be expected to weaponize all known endpoints together
Mitigation
- Patch the query-building logic shared across all
btn_functions.phpfiles, not each module individually — treat this as one systemic defect - Deploy a WAF with SQL injection detection rules across the full
/admins/assessments/path as an interim control - Restrict network exposure of the admin/assessments module to trusted networks only
- Audit database logs for anomalous queries against the
databanktable - Given four disclosed CVEs against the same pattern in under a week, organizations should seriously evaluate migrating off this unmaintained template for any deployment holding real data