CVE-2026-108948
Received Received - Intake

User Profile Update Handler Object Attribute Manipulation in Online Reviewer System

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108948
EUVD
EUVD-2026-98231

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
code-projects Online Reviewer System 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-913 The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108948 is a privilege escalation vulnerability in Online Reviewer System v1.0. It allows low-privileged users like students or teachers to escalate their privileges to administrator by exploiting broken access control and mass assignment in the user profile update endpoint.

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to /reviewer/system/system/admins/manage/users/btn_functions.php for the presence of the usertype_id parameter being modified. Use tools like Burp Suite to intercept and inspect requests for unauthorized role changes. Check server logs for repeated POST requests with usertype_id=1 from non-admin accounts.

Impact Analysis

An attacker can gain full administrative access to the system. This includes managing exams, modifying user data, deleting other users including admins, accessing sensitive information, and potentially achieving remote code execution depending on admin functionalities.

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA due to unauthorized access to sensitive data, potential data breaches, and lack of proper access controls. It may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to btn_functions.php by implementing strict authorization checks. Ensure $_SESSION['usertype_id'] == 1 before processing role modifications. Separate user profile updates from admin-only user management features. Disable mass assignment by validating all input parameters server-side.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108948. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart