Online Exam System EUVD-2026-98851

No special conditions beyond network reachability of the admin panel - the flaw is in the pre-authentication login handler (adminpanel/admin/query/loginExe.php) of SourceCodester Online Exam System 1.0, so a remote unauthenticated attacker can exploit it against a default installation by manipulating the username or pass POST parameters. The only practical limiting factor is that the attacker must be able to reach the application's admin login endpoint; no authentication, user interaction, or non-default configuration is required.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely exploitable, low-complexity, unauthenticated SQL injection in the login endpoint, which is consistent with the description (manipulation of username/pass against loginExe.php before authentication). Publicly available exploit code exists (POC=YES via VulDB and the tracexlabs release), raising practical risk, but this is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the signal is 'exploit exists' rather than 'exploited in the wild.' The CVSS 4.0 Exploit Maturity sub-metric E:P (Proof-of-Concept) corroborates that only a POC, not weaponized/attacked status, is confirmed. The vendor-reported impacts are modest (VC:L/VI:L/VA:L, all Low), which caps the base score at 6.9/MEDIUM despite the unauthenticated network vector; however, a pre-auth SQL injection on a login endpoint realistically risks authentication bypass and database disclosure, so the 'Low' confidentiality rating may understate impact - verify against the published exploit. Net: this is a genuinely exploitable but low-footprint, medium-severity issue in a minor product, not a top-priority emergency absent evidence of targeting.

A remote, unauthenticated attacker sends a crafted POST request to adminpanel/admin/query/loginExe.php with malicious SQL in the username or pass parameter, injecting into the backend query to bypass authentication or extract credentials and data from the database. A public exploit has been published (tracexlabs.com and VulDB), lowering the skill required to reproduce the attack. No user interaction or prior access is needed given the AV:N/PR:N/UI:N vector.