Overview
A SQL injection vulnerability has been disclosed in SourceCodester's Online Reviewer Management System v1.0, a free PHP/MySQL exam-management template widely reused in small deployments and student projects. Tracked as CVE-2026-93959, the flaw lets a remote, unauthenticated attacker inject arbitrary SQL through the Course parameter of btn_functions.php, with a public proof-of-concept already circulating.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-93959 |
| Severity | High (CVSS 3.1: 7.3) |
| Vulnerable File | /reviewer_0/admins/assessments/course/btn_functions.php |
| Parameter | Course |
| Authentication | None required |
| Exploit Maturity | Public PoC available |
How It Works
The Course argument passed to btn_functions.php is concatenated directly into a backend SQL query without parameterization or input sanitization (CWE-89). Because no authentication gate gets in the way, an attacker only needs network access to the vulnerable endpoint to extract, modify, or potentially destroy data in the underlying MySQL database. Researchers note vulnerable instances can be located with a simple Google dork against the endpoint path, making mass discovery trivial.
This flaw is part of a broader cluster of near-identical btn_functions.php SQL injection bugs across different modules of the same product — related endpoints in the subject and databank sections of the assessments module have also been reported (CVE-2026-93972, CVE-2026-93973, CVE-2026-93974). Deployments running this codebase should assume the injection pattern is systemic across the admin/assessments area, not isolated to a single file.
Impact Assessment
Who Is At Risk
- Any organization or individual running Online Reviewer Management System v1.0 with the admin/assessments module reachable over the network
- Given the product's typical use in small schools, training centers, or personal/portfolio deployments, exposure is likely on low-visibility, unmonitored hosts
Potential Impact
- Unauthorized read access to the full application database, including student records, grades, and admin credentials stored in the database
- Data tampering or deletion via injected
UPDATE/DELETEstatements - Potential pivot to further compromise if database credentials are reused elsewhere
Mitigation
- Rewrite the vulnerable query in
btn_functions.php(and itssubject/databanksiblings) to use parameterized queries or prepared statements. This is a self-hosted, low-maintenance codebase — patches will not come from an official vendor channel. - Deploy a Web Application Firewall (WAF) with SQL injection detection rules as an interim compensating control if immediate code changes aren't feasible.
- Restrict network exposure of the admin/assessments module to trusted networks only.
- Audit for signs of prior exploitation — review database logs for anomalous queries against the
course,subject, anddatabanktables. - Given this is unmaintained "SourceCodester"-style template software with a recurring pattern of injection flaws, evaluate whether continued use is appropriate for any deployment handling real student or institutional data.