An unauthenticated SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to compromise database integrity and access sensitive information.

This vulnerability is a SQL injection (CWE-89) flaw located in the /reviewer_0/admins/assessments/course/btn_functions.php endpoint. The application fails to sanitize the Course parameter, permitting unauthenticated remote attackers to inject malicious SQL queries.

Successful exploitation of this flaw can lead to unauthorized database access, sensitive data leakage, and potential data modification or deletion. Given the CVSS score of 7.3, this represents a high-risk security gap that threatens both system confidentiality and the integrity of the information stored within the management system.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected management interface and implement strict input validation on the Course parameter. If possible, consider disabling the vulnerable component until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /reviewer_0/admins/assessments/course/btn_functions.php, particularly those containing SQL syntax characters like single quotes, dashes, or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the Course parameter to provide virtual patching for the environment.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the CVE record.

Due to the lack of an official vendor patch and the presence of a public proof-of-concept, this vulnerability poses a significant risk to affected installations. Administrators must immediately isolate the vulnerable system from public-facing networks and apply strict input filtering to mitigate potential exploitation until the vendor provides a permanent resolution.