Multiple SQL Injection Flaws Uncovered in Open-Source Exam Management Platform

Key facts

In a series of coordinated vulnerability entries registered on Oct. 17, 2026, security analysts at VulDB documented three technical flaws embedded in the Online-Examination-System application. The affected code belongs to the public repository maintained by itsmeravitejak, evaluated up through commit hash e6208e630b14657999bbfe4c9912302d2a1e2449.

The first advisory, documented under CVE-2026-111871, identifies a structured query language injection weakness located within the script subjectsdb.php. According to technical documentation published by VulDB, the file handles operations tied to subject record storage and modification. Unsanitized parameter handling within this component allows database instructions to be augmented by unauthorized external input.

Seconds later, a related disclosure registered as CVE-2026-111872 revealed a comparable weakness inside database.php. VulDB reported that the vulnerability specifically impacts the getreport function, a mechanism used by the platform to query, assemble, and render reporting metrics. When input fields routed to this function fail to undergo strict data type validation or escaping, an attacker can append structured query commands directly to the backend database engine.

The third notice, cataloged as CVE-2026-111873, centers on an asynchronous JavaScript and XML endpoint situated in exammanger.php. As detailed by VulDB, the vulnerability affects the topicslist routine. Because asynchronous endpoints frequently exchange data with client interfaces in the background, inadequately filtered query parameters passed through this endpoint allow external actors to execute arbitrary database statements.

All three vulnerability reports trace the underlying programming issue to insufficient isolation between executable instructions and user-supplied data in legacy PHP web scripting. In each instance, user-controlled input can break out of its intended operational boundary and force the database interpreter to execute unauthorized query fragments.

Why it matters

The identification of multiple database injection vulnerabilities inside an educational assessment platform presents serious security risks for academic institutions and testing centers that deploy self-hosted examination software. Testing platforms manage sensitive academic workflows, including question repositories, active answer sheets, student grading metrics, and administrative credentials. When an assessment platform contains unauthenticated or poorly restricted database access flaws, the integrity of the entire examination process is called into question.

Database injection vulnerabilities, classified in industry frameworks under Common Weakness Enumeration entry CWE-89, permit external entities to bypass standard authentication controls, extract stored records, and alter table contents. In an examination setting, an individual exploiting CVE-2026-111871, CVE-2026-111872, or CVE-2026-111873 could theoretically retrieve unreleased examination questions ahead of scheduled testing sessions. Similarly, the ability to write to the underlying database allows the illicit modification of test outcomes, student transcripts, or user permission levels.

Beyond academic dishonesty, the compromise of student and instructor databases carries regulatory and legal exposure. In jurisdictions governed by strict privacy legislation, such as the European Union under the General Data Protection Regulation or the United States under the Family Educational Rights and Privacy Act, educational organizations face severe administrative penalties if student personally identifiable information is left vulnerable to exfiltration through preventable software defects.

Structured query language injection has remained among the most persistent security weaknesses in web software development for more than two decades. First documented in technical literature in the late 1990s, the vulnerability pattern has consistently occupied a prominent position on the Open Worldwide Application Security Project Top 10 list of critical web application risks. Despite widespread documentation and well-established engineering solutions, web applications constructed using raw procedural PHP code frequently suffer from this class of defect.

The established industry mitigation for structured query language injection relies on parameterized statements, commonly implemented through PHP Data Objects or prepared MySQL improved extension queries. When prepared statements are deployed, the database management system treats incoming parameters strictly as passive data literals rather than executable syntax, nullifying any attempted query modification. Applications that instead rely on direct string concatenation to construct database commands remain inherently vulnerable whenever input sanitization functions are omitted, incomplete, or bypassed.

The international tracking of security defects is coordinated through the Common Vulnerabilities and Exposures system, overseen by the MITRE Corporation under the sponsorship of the United States Cybersecurity and Infrastructure Security Agency. Authorized CVE Numbering Authorities assign unique alphanumeric identifiers to verified defects, enabling software maintainers, enterprise network operators, and incident response personnel to track, index, and remediate technical flaws.

Independent platforms and security indexing services, including VulDB, regularly catalog vulnerabilities uncovered by independent researchers and automated code scanning tools. While large commercial platforms maintain dedicated vulnerability disclosure programs, smaller open-source utilities and independent projects distributed through public repositories like GitHub frequently lack structured security review procedures, leaving deployments dependent on third-party security audits.

Reaction

No formal public statements, defensive advisories, or security bulletins have been issued by the project maintainer, itsmeravitejak, in response to the disclosures published by VulDB. The initial advisories did not include comments from the repository owner, nor did they reference an existing public pull request resolving the vulnerable scripts.

Because open-source projects on collaborative hosting platforms often operate without formal press offices or dedicated response teams, communication surrounding security updates typically unfolds within public repository issue trackers or commit histories. Network administrators and academic technical teams using the software are expected to review their server installations, enforce local network access controls, and monitor repository activity for forthcoming patches.

Security analysts monitoring educational software vulnerabilities frequently recommend that system operators deploy external protective layers, such as web application firewalls, to detect and block malformed structured query syntax before it reaches vulnerable endpoints in unpatched application servers.

What we don't know yet

Several practical aspects regarding the discovery and real-world exposure of these flaws remain unverified. The initial disclosures from VulDB do not specify whether the vulnerabilities were uncovered through automated source-code analysis, manual penetration testing, or active exploitation detected in operational environments. Consequently, it remains unknown whether malicious actors have leveraged these specific endpoints against production examination servers.

Additionally, the reporting does not quantify how many institutions, schools, or individual administrators actively deploy the itsmeravitejak Online-Examination-System codebase. While public git repositories indicate the codebase's revision history up to commit e6208e630b14657999bbfe4c9912302d2a1e2449, the number of live internet-facing installations remains undocumented.

It is also unclear whether an official security patch will be merged into the primary repository or if system operators must manually refactor subjectsdb.php, database.php, and exammanger.php to implement prepared database queries independently.

What to watch

The primary development to monitor is whether the maintainer publishes updated software commits that replace dynamic query assembly with parameterized database interactions across the affected files. Users of the repository should monitor subsequent commit activity past hash e6208e630b14657999bbfe4c9912302d2a1e2449 for security fixes.

In the broader vulnerability management space, observers should watch for the publication of standardized Common Vulnerability Scoring System metrics for CVE-2026-111871, CVE-2026-111872, and CVE-2026-111873. These severity scores, assigned by vulnerability evaluators and mirrored by institutions such as the United States National Vulnerability Database, establish the baseline exploitability and impact ratings used by automated compliance checkers.

Security teams managing self-hosted examination environments should also watch for the emergence of public proof-of-concept exploit scripts targeting the exammanger.php topicslist AJAX endpoint or the database.php getreport function, which would significantly elevate the urgency of manual code remediation.

This account is based on technical vulnerability reporting published by VulDB across its security catalog entries on Oct. 17, 2026.