CVE-2026-111873
7.3HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Remote, unauthenticated attackers can execute arbitrary SQL queries against the database to read, modify, or delete data. All they need is network access to the application's AJAX endpoints.
Root cause
The MySQLDB::topicslist function in exammanger.php fails to sanitize user input provided to the 'subject' parameter before embedding it in a database query.
Affected systems
itsmeravitejak Online-Examination-System commit e6208e630b14657999bbfe4c9912302d2a1e2449 and earlier.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No upstream patch exists yet. Block external access to exammanger.php or apply WAF rules to sanitize/drop requests containing SQL injection payloads in the 'subject' parameter.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.