A vulnerability has been discovered in the Online‑Examination‑System's AJAX endpoint exammanger.php, specifically within the topicslist function. The function accepts a subject parameter that is concatenated directly into a SQL query, allowing an attacker to inject arbitrary SQL code. The vulnerability is remotely exploitable and a public exploit is already available. Successful exploitation would enable an attacker to read, modify, or delete data in the underlying database, potentially exposing sensitive exam information. This is a classic SQL injection flaw (CWE‑89).

All deployments of the itsmeravitejak Online‑Examination‑System are potentially impacted as the project follows a rolling‑release model with no discrete version numbers. The source code reference indicates that the vulnerability exists up to commit e6208e630b14657999bbfe4c9912302d2a1e2449. Because no patched release has been released yet and the vendor has not responded, any instance running a vulnerable code base is at risk.

The CVSS score of 6.9 denotes a medium severity vulnerability. EPSS information is not available, but the vulnerability is listed as not in the KEV catalog, implying it has not yet been reported as exploited at scale. However, the public nature of an exploit and the remote attack vector suggest that an adversary could easily target the endpoint. Without a vendor patch, the primary threat remains uncontrolled injection endpoints that can compromise database integrity and confidentiality.