The code-projects Online Reviewer System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise system data.

This flaw is a SQL injection vulnerability (CWE-89) triggered via the test_id parameter in the /system/system/admins/assessments/pretest/exam-update.php script. The vulnerability allows unauthenticated remote attackers to inject malicious SQL queries into the application database.

Successful exploitation of this vulnerability could lead to unauthorized access to the underlying database, potentially resulting in the exposure, modification, or deletion of sensitive assessment data. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the system, which may lead to operational disruption and loss of trust in the review process.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the vulnerable endpoint or take the application offline until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the exam-update.php file, and monitor database audit logs for unauthorized query activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads directed at the vulnerable URL path.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running Online Reviewer System 1.0 must treat this as a high-priority issue. If an official update is not provided by the vendor, migration to a more secure platform or complete isolation of the vulnerable system is strongly advised to prevent unauthorized database access.