A critical SQL injection vulnerability in code-projects Online Reviewer System 1.0 allows for remote, unauthenticated database manipulation.

This vulnerability is a SQL injection flaw (CWE-89) located in the /reviewer/system/system/admins/manage/users/user-delete.php script. The application fails to properly sanitize the ID parameter, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

Successful exploitation of this flaw allows an attacker to interact directly with the backend database, potentially leading to unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this represents a significant risk to data integrity and confidentiality, which could result in compliance violations and loss of sensitive user information.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the affected directory or disable the vulnerable component until a vendor update is released.

Proactive Monitoring: Review application access logs for suspicious patterns, such as unexpected SQL syntax or URL parameters containing non-alphanumeric characters, targeting the user-delete.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to block and alert on SQL injection attempts targeting the identified vulnerable path.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the provided GitHub issue reference.

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a clear and present danger to affected systems. Organizations utilizing code-projects Online Reviewer System 1.0 must take immediate steps to isolate the application or apply compensating controls to prevent unauthorized database access. Prioritize the replacement of this system if the vendor fails to provide a security update in a timely manner.