The Online Reviewer System 1.0 is susceptible to remote SQL injection, which could allow an unauthenticated attacker to compromise backend database integrity.

This vulnerability is a SQL injection (CWE-89) flaw located in the file /system/system/students/assessments/pretest/take/index.php. The application fails to properly sanitize the ID argument, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data, modification of assessment records, or potential disruption of service within the Online Reviewer System. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to data confidentiality and application availability, particularly if the database stores user or academic information.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected script or disable the vulnerable module until a vendor-provided update is released.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically looking for SQL syntax characters or unexpected parameter values targeting the /system/system/students/assessments/pretest/take/index.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the identified URL parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at the referenced GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, organizations using the Online Reviewer System must prioritize isolating the affected application from public networks. IT teams should monitor the vendor for security patches and apply them immediately upon release to remediate this critical injection flaw.