Online Examination System CVE-2026-111872

Exploitation requires sending attacker-controlled input through the id, user, or topic parameters to the vulnerable MySQLDB methods (valid, getresults, noresults, getExams, latestExamID, getreport) reached via results.php / include/database.php, where the values are concatenated into SQL without sanitization. Per the CVSS vector no special configuration, user interaction, or privileges are claimed (AV:N/AC:L/PR:N/UI:N), meaning default deployments are reachable remotely; however, the realistic limiting factors are (1) the instance must be network/internet-exposed, and (2) the affected exam/report endpoints are typically behind a login in this class of application, so authenticated access may in practice be required - this is not confirmed in the data. There is no patched release to deploy because the product ships as a rolling release and the maintainer has not responded.

This is a genuinely medium-to-low priority issue despite being an unauthenticated SQL injection. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with E:P yields a base-threat score of 5.5, and the limited impact (VC:L/VI:L/VA:L, no scope change) reflects that the flaw affects a small hobby project rather than a high-value target. Signals are consistent rather than conflicting: a public proof-of-concept exists (the GitHub issue report), but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of real-world or widespread exploitation - exploitation status is best described as 'publicly available exploit code exists', which is a weaker signal than active exploitation. One point to verify: the CVSS vector asserts PR:N (unauthenticated), yet the affected functions (getExams, latestExamID, getreport, getresults) are typical of post-login student/examiner pages, so the true access requirement may be authenticated - verify against results.php access control before assuming fully anonymous reach. The dominant risk-limiting factor is low prevalence: this is an obscure, unmaintained GitHub project with no enterprise footprint, so the practical blast radius is minimal.

A remote attacker locates an internet-exposed instance of the Online-Examination-System and submits a crafted request to results.php (or other endpoints) that places malicious SQL into the id, user, or topic parameter, which is passed unsanitized into MySQLDB query methods. A public proof-of-concept exists via the project's GitHub issue tracker, and because CVSS rates attack complexity as low (AC:L) the injection can be triggered with a single HTTP request to read or tamper with exam and user records.