A critical SQL injection vulnerability in code-projects Online Reviewer System 1.0 enables unauthenticated remote attackers to manipulate database queries.

This is a SQL injection vulnerability (CWE-89) located in the /system/system/admins/assessments/pretest/loaddata.php file. An unauthenticated attacker can manipulate the difficulty_id argument to execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive assessment data, potential modification of records, or the exposure of administrative credentials. With a CVSS score of 7.3, this flaw is categorized as high severity and requires immediate attention to prevent unauthorized data exfiltration.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the vulnerable loaddata.php endpoint or disable the affected assessment component entirely until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected parameters directed at the /system/system/admins/assessments/pretest/ directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the difficulty_id parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up provided by the researcher at https://github.com/tiancesec/CVE/issues/19.

Given the availability of a public proof-of-concept and the lack of a vendor patch, this vulnerability presents a tangible risk to the environment. Security teams must prioritize identifying instances of this software within their infrastructure and implement strict network-level access controls to negate the potential for remote exploitation.