SourceCodester Online Reviewer Management System 1.0 contains a SQL injection vulnerability in the difficulty_id parameter of the /reviewer_0/admins/assessments/databank/btn_functions.php?action=add endpoint. This allows remote attackers to manipulate SQL queries by injecting malicious input, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 6.9 (medium severity). Public exploit details are available, but no vendor patch or advisory has been disclosed.

Successful exploitation of this SQL injection vulnerability can allow remote attackers to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, data modification, or other database-related impacts depending on the database privileges. The vulnerability is exploitable remotely without authentication, increasing its risk. However, no active exploitation in the wild has been reported.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the difficulty_id parameter. Input validation and parameterized queries should be applied if source code access is possible.