CVE-2026-108956
Received Received - Intake

SQL Injection in Online Reviewer System

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108956
EUVD
EUVD-2026-98235

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
code-projects Online Reviewer System 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated SQL injection vulnerability in Online Reviewer System v1.0. The flaw exists in the user update handler file where unsanitized inputs are directly used in an SQL UPDATE statement. Attackers can inject SQL comments to bypass authentication and overwrite all user credentials including admin accounts without any prior access.

Detection Guidance

To detect this SQL injection vulnerability, test the affected parameter in /reviewer/system/system/admins/manage/users/btn_functions.php by injecting SQL comment syntax like ' OR '1'='1' -- - or ' OR 1=1 -- - into user input fields such as password. Use tools like sqlmap with: sqlmap -u 'http://target.com/reviewer/system/system/admins/manage/users/btn_functions.php' --data='password=test&user_id=1' --risk=3 --level=5.

Impact Analysis

This vulnerability allows remote attackers to take over all user accounts including administrators without authentication. They can steal data, modify or delete records, escalate privileges, and cause complete system compromise. The exploit is automated and requires no interaction from victims.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized data access, modification, or destruction. It enables complete data breaches which are reportable under these regulations. Organizations using this system would face compliance failures, legal penalties, and mandatory breach notifications.

Mitigation Strategies

Immediately apply input validation and sanitization for all user inputs. Replace direct SQL queries with prepared statements using parameterized queries. Ensure strict session validation to prevent unauthorized access. Disable or restrict access to the vulnerable file if possible until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108956. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart