The vulnerability identified as CVE-2026-102909 affects SourceCodester Online Reviewer Management System 1.0. It is a SQL injection vulnerability caused by improper sanitization of the access_code argument in a function located in /reviewer_0/admins/assessments/examproper/btn_functions.php. This allows remote attackers to execute arbitrary SQL commands by manipulating the access_code parameter. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 6.9, indicating medium severity. Public exploit code exists, but there is no indication of active exploitation or an official patch.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL queries on the backend database. This may lead to unauthorized data access, modification, or other database impacts depending on the application's database permissions. The vulnerability does not require authentication and can be triggered remotely, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

No official patch or remediation guidance is currently available for this vulnerability. Users of SourceCodester Online Reviewer Management System 1.0 should monitor the vendor's advisories for updates. In the absence of a patch, consider applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the access_code parameter. Avoid exposing the vulnerable functionality to untrusted networks if possible.