Online Examination System CVE-2026-111992

Requires an authenticated low-privilege account (PR:L) on the Online Examination System; the attacker then manipulates the topicid argument passed to the Exam::startExam function in exam.php of the Exam Module to inject SQL. Exploitation is remote over the network with no user interaction (AV:N/UI:N) against the rolling-release codebase up to commit e6208e630b14657999bbfe4c9912302d2a1e2449. Limiting factors: a valid application login is needed (not unauthenticated), the vulnerable code path is the exam-start flow, and no fixed version exists since the project uses an unversioned rolling release.

This is a low real-world priority despite being a publicly-exploitable SQL injection (CWE-89). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields only 2.1, reflecting low-privilege-required access and self-assessed LOW impact on confidentiality, integrity, and availability - unusual for SQLi, which commonly enables full database disclosure. The E:P (Proof-of-Concept) exploit maturity is corroborated by a public exploit on GitHub, so the 'exploit exists' signal is confirmed, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The signals are therefore mildly conflicting: a public POC raises opportunistic risk, but the obscure product footprint, required authentication (PR:L), and vendor-rated low impact all cap the practical severity. Note the impact tension explicitly: a topicid SQL injection could realistically reach HIGH confidentiality (arbitrary DB read) rather than the vendor's VC:L - verify the injection's reach against the actual query before downgrading. No KEV and no EPSS means exploitation likelihood cannot be quantified from the input.

An attacker with a low-privilege account on the Online Examination System sends a crafted request to the Exam Module's startExam function (exam.php), injecting SQL via the topicid parameter to read or tamper with backend database contents. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier. Exploitation is remote and requires no user interaction, but does require an authenticated session.