A critical SQL injection vulnerability in code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate database queries.

This flaw is a SQL injection (CWE-89) triggered through the difficulty_id argument within the file /system/system/admins/assessments/pretest/btn_functions.php. The vulnerability is remotely exploitable without requiring authentication.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data integrity, confidentiality, and availability. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized access to sensitive administrative data or total compromise of the database backend, resulting in significant operational disruption.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected administrative directory using network-level controls or disable the vulnerable component entirely.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests containing SQL syntax, specifically targeting the /system/system/admins/assessments/pretest/btn_functions.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests containing SQL injection patterns targeting the identified vulnerable parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the GitHub issue report referenced in the vulnerability documentation.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an immediate risk. Organizations utilizing this software must implement strict access controls and WAF filtering to prevent exploitation until the vendor releases a secure update.