SourceCodester Online Reviewer Management System 1.0 contains a SQL injection vulnerability in the /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove endpoint. An attacker can manipulate the ID parameter to inject SQL commands, potentially compromising the backend database. The vulnerability is remotely exploitable without any privileges or user interaction. Exploit code has been published, increasing the risk of exploitation. The CVSS 4.0 score is 6.9 (medium severity) reflecting network attack vector, low complexity, no privileges required, and no user interaction needed. No official patch or mitigation guidance is currently provided.

Successful exploitation allows an unauthenticated remote attacker to perform SQL injection via the ID parameter, potentially leading to unauthorized data access or modification in the backend database. The published exploit increases the likelihood of attacks, but no active exploitation has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected endpoint if possible and monitor for suspicious activity related to the ID parameter. Avoid exposing the vulnerable functionality to untrusted users.