CVE-2026-109620: SQL Injection in SourceCodester Online Reviewer System

SourceCodester Online Reviewer System 1.0 contains a SQL injection vulnerability in the login/index.php file affecting the PDO::prepare function. By manipulating the username or password arguments, an attacker can inject SQL commands. This vulnerability is remotely exploitable and public exploit code has been disclosed. The CVSS 4.0 score is 6.9, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is limited to confidentiality, integrity, and availability but does not require authentication or user interaction.

No official patch or remediation guidance is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected login interface and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the username and password parameters.