EUVD-2026-103382
GHSA-2qc2-gvjr-chrr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Online Examination System endpoint
-
ExploitInject SQL via query/qtype/sortname/sortorder parameter
-
ExecutionBackend executes manipulated query
-
ImpactRead or modify exam/user database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a reachable, deployed instance of itsmeravitejak Online-Examination-System and attacker-supplied input to the query, qtype, sortname, or sortorder arguments handled by qsdb.php, usersdb.php, brandb.php, topicsdb.php, or subjectsdb.php. Per CVSS PR:N/UI:N, no authentication or victim interaction is required against a default deployment. The principal limiting factor is exposure: this is an obscure, unmaintained PHP application that is rarely deployed and seldom internet-facing, so realistic attack surface is small despite the easy technical conditions. |
| Impact | Signals are consistent but point to a low-to-moderate, opportunistic threat rather than a top priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, but all impact metrics are only Low (VC:L/VI:L/VA:L) and the input score is 6.9. The input carries no EPSS score and no CISA KEV listing, so there is no evidence of active or widespread exploitation; the embedded Exploit Maturity metric E:P (Proof-of-Concept) matches the stated 'POC publicly available' (a GitHub issue), confirming exploit code exists but not that it is being used in the wild. No SSVC decision data was provided. The dominant risk-reducing factor is the target itself: an unmaintained, unversioned hobby project ('itsmeravitejak/Online-Examination-System') with the vendor unresponsive to the report - meaning there is no patch, but also a very small real-world footprint. Net: a genuine, easy-to-exploit SQLi against any exposed instance, but of limited aggregate risk because deployment is rare and no active exploitation is indicated. |
| Exploit ScenarioDerived | An attacker who can reach a deployed instance over the network sends crafted values in the query, qtype, sortname, or sortorder parameters to one of the vulnerable PHP endpoints (e.g., subjectsdb.php), injecting SQL to read or alter the exam database. No authentication or user interaction is required (PR:N/UI:N). Public proof-of-concept detail exists via the project's GitHub issue tracker, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
SQL injection in itsmeravitejak's PHP-based Online-Examination-System lets remote, unauthenticated attackers inject arbitrary SQL through the query, qtype, sortname, and sortorder arguments processed by qsdb.php, usersdb.php, brandb.php, topicsdb.php, and subjectsdb.php. Because the project uses no versioning, there is no reliable way to determine which snapshots are affected; the repository's latest known commit e6208e630b14657999bbfe4c9912302d2a1e2449 is in scope, and the maintainer has not responded to the issue report. Publicly available exploit code exists (the CVE record's CVSS 4.0 vector carries E:P), but there is no KEV listing or other indication of active exploitation, and independent assessment rates the practical risk as low-to-moderate and opportunistic because deployments of this obscure, unmaintained application are rare and seldom internet-facing.
RemediationAI
No vendor-released patch is identified at time of analysis: the maintainer was notified via a GitHub issue (https://github.com/itsmeravitejak/Online-Examination-System/issues/5) and has not responded, and there are no tagged releases to upgrade to, so only compensating controls apply. Because the flaw is SQL injection rather than a code-execution bug, the most effective fix is host-side hardening: enforce parameterized queries via mysqli/PDO prepared statements and replace user-controlled sortname/sortorder values with server-side column allowlists - note that ORDER BY cannot be bound as a placeholder, so a strict whitelist is mandatory, and this requires forking and maintaining the code yourself, which carries ongoing effort. Until then, restrict the application behind an authenticating reverse proxy or VPN so only trusted examiners reach qsdb.php, usersdb.php, brandb.php, topicsdb.php and subjectsdb.php, accepting that this breaks anonymous candidate access if the app is student-facing; block direct requests to those five scripts at the web server and disallow any query strings containing SQL keywords as a blunt backstop, at the cost of potential false positives and bypassability. Deploy WAF/ModSecurity rules targeting SQLi patterns in the query, qtype, sortname, and sortorder parameters, recognising that signature evasion is feasible. Run the application's database account with least privilege (no DROP, no FILE, no stacked-statement rights) to cap damage from any bypass, and monitor for anomalous queries or error-based probing. If the application is not actively required, decommissioning the instance is the safest option, since no upstream fix is expected. Consult https://vuldb.com/vuln/421583 and https://vuldb.com/cve/CVE-2026-111871 for any later update.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is a hand-written PHP examination/quiz application that builds SQL statements directly from HTTP request parameters in its CRUD helper files (qsdb.php, usersdb.php, brandb.php, topicsdb.php, subjectsdb.php). The root cause is CWE-89, improper neutralization of special elements used in an SQL command: the sortname and sortorder style parameters are typical ORDER BY/GROUP BY injection points where prepared statements and placeholders are not usable without a column allowlist, while query and qtype parameters likely flow into WHERE clauses. Missing parameterization means an attacker controls SQL syntax rather than just data, enabling data disclosure, authentication bypass, and in some configurations stacked statements or file/command execution depending on the database engine, though the CVE record and independent assessment scope impact only to low confidentiality, integrity, and availability. The CPE cpe:2.3:a:itsmeravitejak:online-examination-system:*:*:*:*:*:*:*:* with a wildcard version reflects the vendor's complete absence of release tagging, so no version-range disambiguation is possible; only the referenced commit hash identifies the reviewed snapshot. The authoritative assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L confirms a network-reachable, unauthenticated, no-interaction attack that is technically trivial, with exposure of the deployment being the primary limiting factor rather than any defensive control.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated SQLi via HTTP parameters gives AV:N/AC:L/PR:N/UI:N; impacts kept Low across C/I/A, consistent with the input's VC:L/VI:L/VA:L and limited scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB