Description
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php. The manipulation of the argument id/user/topic leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-18
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection leading to data exposure or manipulation
Action: Apply Patch
AI Analysis

Impact

The vulnerability arises from the manipulation of the id, user, and topic arguments in the database.php functions of the Online-Examination-System. This allows an attacker to inject arbitrary SQL through the getreport endpoint, resulting in potential unauthorized data retrieval or modification. The weakness is classified as CWE-74 and CWE-89, reflecting improper handling of untrusted input and lack of input sanitization.

Affected Systems

The affected system is the Online-Examination-System developed by itsmeravitejak. No specific version details are available due to the project’s rolling release model, and affected revisions include those up to the commit e6208e630b14657999bbfe4c9912302d2a1e2449.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate impact. EPSS is not available, and the vulnerability is not currently listed in CISA’s KEV catalogue. Because the attack can be initiated remotely and the exploit has been publicly disclosed, the risk of exploitation remains significant for administrators unaware of mitigation steps.

Generated by OpenCVE AI on October 18, 2026 at 05:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy an updated release of the Online-Examination-System that resolves the injection flaw, or request the vendor to provide a patch.
  • Implement strict input validation and parameterized queries in the getreport function to neutralize user-supplied data.
  • Reduce database privileges for the application account to the minimum required, limiting the potential damage of any injection that may still succeed.

Generated by OpenCVE AI on October 18, 2026 at 05:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php. The manipulation of the argument id/user/topic leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Title itsmeravitejak Online-Examination-System database.php getreport sql injection
First Time appeared Itsmeravitejak
Itsmeravitejak online-examination-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsmeravitejak:online-examination-system:*:*:*:*:*:*:*:*
Vendors & Products Itsmeravitejak
Itsmeravitejak online-examination-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsmeravitejak Online-examination-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-18T04:00:19.161Z

Reserved: 2026-10-17T09:35:05.758Z

Link: CVE-2026-111872

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T04:16:35.433

Modified: 2026-10-18T04:16:35.433

Link: CVE-2026-111872

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T06:00:08Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')