A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. (CVE-2026-111992)

The itsmeravitejak Online-Examination-System contains a SQL injection vulnerability in the Exam Module, specifically in the Exam::startExam function within exam.php. This vulnerability arises from improper sanitization of the 'topicid' argument, allowing remote attackers to inject SQL commands. The product uses a rolling release model, so specific affected versions are not clearly defined. The issue was reported early to the project, but no response or patch has been issued. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability can lead to unauthorized access or modification of the database, potentially impacting confidentiality, integrity, and availability of the system. The CVSS score of 6.3 indicates a medium severity impact with low attack complexity and no user interaction required. The vulnerability can be exploited remotely by an attacker with low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. In the meantime, consider implementing input validation or web application firewall rules to mitigate SQL injection attempts targeting the 'topicid' parameter.