The Online Examination 1.0 application contains a flaw in its Quiz Creation Feature where user input for addquiz is directly concatenated into SQL statements. Parameters such as name, total, right, wrong, time, tag, and desc are not properly escaped, exposing the system to classic SQL injection attacks (CWE-74 and CWE-89). An attacker could craft input that executes arbitrary SQL commands, potentially exfiltrating data, modifying records, or causing denial of service against the underlying database.

The vulnerability is present in the Online Examination application distributed by code‑projects, specifically in the /update.php addquiz endpoint. No other product versions are listed as affected, but the description references version 1.0 and does not confirm whether newer releases remain vulnerable. The attack vector is limited to this endpoint, and no additional components have been identified as impacted.

The CVSS score of 5.3 indicates a moderate risk to confidentiality and integrity, while the EPSS score of less than 1% suggests exploitation is expected to be rare in the wild. However, publicly available exploits exist and the flaw can be triggered remotely via crafted HTTP requests to /update.php, making any environment running this code vulnerable to database compromise. Although the risk is not classified as urgent by CISA KEV, the potential impact of arbitrary SQL execution warrants immediate remediation.