Online Quiz Maker 1.0 includes SQL injection vulnerabilities in the catid and usern parameters that let authenticated attackers send crafted POST requests to quiz-system.php or add-category.php. By injecting malicious SQL, an attacker can read or modify the database, extract sensitive information, or bypass authentication controls. This can compromise confidentiality and integrity of the quiz content and user data.

The vulnerability affects Hscripts' Online Quiz Maker 1.0. No specific version extensions are noted beyond the base release, and no additional vendors are listed.

The CVSS score of 7.1 indicates high impact, but the EPSS score is unavailable, making it unclear how frequently this flaw is exploited in the wild. The flaw is not listed in CISA’s KEV catalog. The attack vector is web‑based; an attacker must be authenticated to the application and can submit malicious POST payloads. Given the lack of public exploitation and the need for authentication, the likelihood is moderate, but the potential damage if exploited is significant.