Description

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-13T06:16:47.567Z",
  "pubdate": "2026-10-13T06:16:47.567Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the Online-Examination-System (commit e6208e630b14657999bbfe4c9912302d2a1e2449).\nThe vulnerability resides within the MySQLDB::addNewUser function located in include/database.php, specifically affecting the handling of the 'branch' argument during the user registration process.\nThis flaw allows remote, unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized data exfiltration, modification, or full compromise of the underlying database.\nGiven that the exploit is publicly available and the vendor has not provided a response or patch, the risk to deployments is high.\nThe application follows a rolling release model, meaning all current instances are potentially vulnerable until specific defensive measures are applied.",
  "technicalDetails": "The root cause of the vulnerability is the improper neutralization of special elements used in an SQL command within the MySQLDB::addNewUser function in include/database.php.\nThe application fails to employ parameterized queries or prepared statements when processing the 'branch' input parameter from the Registration Form.\nConsequently, an attacker can supply crafted input containing SQL syntax characters (e.g., single quotes, comment sequences) that escape the intended data context, allowing for the injection of arbitrary SQL commands.\nThe attack flow proceeds as follows: An attacker navigates to the Registration Form and intercepts or crafts a POST request. By injecting malicious SQL payloads into the 'branch' parameter, the attacker forces the database to execute unintended operations. For example, by inserting ' OR 1=1 --, the attacker may bypass filters or force the database to return records they are not authorized to view.\nBecause the input is passed directly into a database query string, the application is susceptible to techniques such as Union-based SQL injection, Blind SQL injection, or Error-based SQL injection, depending on the server configuration and database settings.\nThe vulnerability is remotely exploitable without the need for prior authentication, as it occurs within the user registration interface.\nSuccessful exploitation grants the attacker the ability to interact with the database backend directly. The post-exploitation impact includes the potential for unauthorized access to sensitive user information, administrative credentials stored in the database, modification of application logic, or complete denial of service via database corruption or resource exhaustion.\nGiven that the project has not responded to vulnerability reports, there is currently no upstream patch available. The vulnerability exists up to commit e6208e630b14657999bbfe4c9912302d2a1e2449, and users must rely on manual input validation and sanitization as temporary mitigation measures."
}