Description
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Immediate Patch
AI Analysis

Impact

A flaw in the MySQLDB::addNewUser function of the registration system allows an attacker to inject arbitrary SQL commands because input is not properly sanitized. The vulnerability is a typical SQL injection (CWE-89) combined with improper argument handling (CWE-74). An attacker could read, alter, or delete database records, which compromises confidentiality and integrity of user data and could lead to a full compromise of the application.

Affected Systems

The software product is itsmeravitejak Online-Examination-System. The affected code base includes all releases prior to commit e6208e630b14657999bbfe4c9912302d2a1e2449. No fixed release version has been published at this time because the project uses a rolling-release model.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered remotely through the web registration form, and public exploits are available, making the risk higher for exposed deployments.

Generated by OpenCVE AI on October 13, 2026 at 06:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the application to a version that contains the vendor’s fix, if one becomes available.
  • Modify the addNewUser routine to use parameterized queries or prepared statements to eliminate unsanitized input.
  • Limit the database account used by the application to the minimum privileges required for normal operation.
  • Deploy a web application firewall that filters for SQL injection patterns on the registration endpoint.

Generated by OpenCVE AI on October 13, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Title itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection
First Time appeared Itsmeravitejak
Itsmeravitejak online-examination-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsmeravitejak:online-examination-system:*:*:*:*:*:*:*:*
Vendors & Products Itsmeravitejak
Itsmeravitejak online-examination-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsmeravitejak Online-examination-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-16T21:37:14.373Z

Reserved: 2026-10-11T19:43:51.501Z

Link: CVE-2026-108970

cve-icon Vulnrichment

Updated: 2026-10-16T21:37:09.887Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T06:16:47.567

Modified: 2026-10-16T22:17:17.863

Link: CVE-2026-108970

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:23:25Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')