A SQL injection flaw exists in the Exam::startExam function of the online examination system. By manipulating the topicid parameter, an attacker can inject arbitrary SQL statements, potentially gaining read, modify or delete access to the underlying database. The vulnerability is an example of improper neutralization of user input (CWE-74) and classic SQL injection (CWE-89).

The flaw affects the vendor itsmeravitejak’s Online-Examination-System component. Vulnerable releases include the code state identified by the commit hash e6208e630b14657999bbfe4c9912302d2a1e2449. No specific version list is available due to the product’s rolling release model, so any build derived from that commit or subsequent unpatched releases may be impacted.

The CVSS score of 5.3 indicates a moderate severity, and the exploit is available publicly, meaning remote attackers can trigger it without prior authentication. With no known mitigations currently provided by the vendor, the risk remains high for misusing the injection to exfiltrate or alter exam data. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely a remote use of the exam.php endpoint by supplying a crafted topicid. Given the lack of a patch and the product’s lack of response, the vulnerability poses a significant threat to the confidentiality and integrity of examination data.