Online Examination System CVE-2026-108970

Exploitation requires that the publicly reachable registration form of itsmeravitejak Online-Examination-System be exposed and processing user input through MySQLDB::addNewUser; the attacker manipulates the 'branch' argument to inject SQL. No authentication, no user interaction, and no non-default configuration are required - the registration form is intended to be pre-authentication. The practical limiting factor is exposure and impact scope: the product must be deployed and internet-reachable, and CVSS impact is rated Low across confidentiality/integrity/availability, implying partial rather than full database compromise. Because the project uses rolling releases with no vendor fix, there is no patched version to upgrade to; mitigation depends on input sanitization or restricting access to the instance.

Signals are consistent but point to a genuinely modest real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, which is credible because the flaw sits in the public registration form (MySQLDB::addNewUser) where no prior authentication is expected. However, the impact metrics are all Low (VC:L/VI:L/VA:L) and scope is unchanged, yielding a 6.9 base score rather than a critical rating. The CVSS vector carries E:P (Proof-of-Concept) and POC availability is confirmed, matching the exploit reference, but there is NO CISA KEV listing and NO EPSS score supplied, so there is no evidence of widespread or automated exploitation. The dominant risk-reducer is product prevalence: this is a single-developer GitHub project under a rolling-release model, not enterprise software. Net: a real, publicly-exploitable SQLi worth patching on any live instance, but not an organizational priority driven by exploitation pressure - treat it as 'exploit exists against an obscure product' rather than an actively-weaponized threat.

A remote, unauthenticated attacker submits the Online-Examination-System registration form and injects crafted SQL into the 'branch' parameter, which MySQLDB::addNewUser passes unsanitized into a query in include/database.php. A public proof-of-concept exists (linked from the project's GitHub issue tracker), so an attacker can read or tamper with limited database contents without needing credentials or user interaction.