Online Examination System CVE-2026-111873

Exploitation requires the attacker to reach the AJAX endpoint implemented in exammanger.php and supply the 'subject' parameter processed by the MySQLDB::topicslist function; the injection point is that specific parameter. Per the provided CVSS vector (PR:N/UI:N) no authentication or user interaction is needed and default configurations are affected, since this is a single-codebase rolling-release app with no version gating. Limiting factors: the only meaningful constraint is network reachability of the application and whether this AJAX route is in practice gated behind an authenticated session - the CVSS marks it PR:N, but this should be confirmed against the source, as impact is bounded to Low (partial DB read/write, no subsequent-system scope).

Signals are mixed and point to a genuine-but-low-urgency issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, which normally argues for priority; however, the vulnerable-system impacts are all Low (VC:L/VI:L/VA:L) and there is no subsequent-system impact (SC/SI/SA:N), yielding a moderate 6.9 base score. The SSVC/threat metric E:P (Proof-of-Concept) and the stated public exploit confirm exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided in the input, so widespread or automated exploitation cannot be asserted. Crucially, the real-world risk is dampened by the target itself: this is an obscure open-source GitHub project ('itsmeravitejak/Online-Examination-System') with no enterprise deployment base, discovered and reported by VulDB with no vendor response. Net: a legitimate, publicly-exploitable SQLi, but far closer to a low-real-risk finding than a fleet-wide emergency given the trivial deployment footprint. Note the authentication claim depends entirely on the provided PR:N - the AJAX endpoint may in practice sit behind a login, which would further reduce exposure; verify against the source.

A remote attacker sends a crafted request to the AJAX endpoint exammanger.php, injecting malicious SQL through the 'subject' parameter consumed by MySQLDB::topicslist. Because exploit code is publicly available (referenced on the project's GitHub issue tracker), an attacker can replay it directly to read or tamper with exam database contents. Per the CVSS vector no authentication or user interaction is required, though realistic impact is limited (Low confidentiality/integrity/availability).