Summary
SourceCodester Online Reviewer Management System 1.0 contains a SQL injection vulnerability in the assessment deletion endpoint. A remote attacker who can reach the endpoint may manipulate the test_id parameter to alter database queries, particularly where input is not safely validated or parameterized.
Affected context
The vulnerability occurs in the administrative assessment workflow at /reviewer_0/admins/assessments/pretest/exam-delete.php. It becomes risky when the application accepts remotely supplied test_id values and incorporates them into database queries without reliable parameter binding or strict validation. Exploitability may also depend on endpoint exposure and any authentication or authorization controls protecting the administrative area.
Exploit preconditions
- Attack surface: HTTP request handling for the assessment deletion endpoint
- Required access: Network access to the application; authentication requirements depend on deployment and access-control configuration
- Trigger point: Processing of the
test_idargument byexam-delete.php - Why exploitation is possible: The parameter may be interpreted as part of a database query when input is not isolated from SQL syntax through parameterized operations
Why this happens
The underlying bug is an injection flaw in which externally controlled input reaches a SQL statement without sufficient separation between data and executable query structure. This maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). The broader CWE-74 classification reflects the failure to neutralize control elements in an interpreter-specific context.
Potential impact
- An attacker may read data that should remain restricted
- Database records may be modified or deleted
- Application authentication or authorization data could be exposed
- The application may experience integrity loss or service disruption
- Additional compromise could occur if the database account has excessive privileges
General mitigation guidance
Mitigation generally focuses on ensuring that user-controlled values cannot become part of SQL command structure.
Common defensive patterns include:
- Use parameterized queries or prepared statements for all database operations
- Apply strict server-side validation and type enforcement to identifier values such as
test_id - Avoid constructing SQL statements through string concatenation
- Enforce authorization checks independently of input validation for assessment deletion actions
- Run the application database account with only the privileges required for normal operation
- Reduce direct exposure of administrative endpoints through authentication, network boundaries, and secure session controls
- Use secure-by-default data-access abstractions that separate query parameters from query text
How teams detect issues like this
Organizations can look for SQL injection risks through:
- Static analysis rules identifying string concatenation or interpolation in SQL statements
- Code review checks for request parameters passed directly into database APIs
- Dynamic testing of identifier and filter parameters using safe security test cases
- Web application firewall or gateway policies that detect suspicious query-manipulation patterns
- Database monitoring for unexpected query shapes, privilege use, deletion activity, or abnormal access to sensitive tables
- Automated security review tools integrated into development and CI workflows
