This vulnerability (CVE-2025-4686) is an instance of CWE-89 SQL Injection in the Online Exam and Assessment product by Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. It arises from improper neutralization of special elements in SQL commands, enabling attackers to manipulate backend database queries. The CVSS 3.1 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. The vendor was contacted but did not respond, and no patch or mitigation guidance is currently available.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, data modification, or denial of service. The CVSS vector indicates the vulnerability can be exploited remotely without privileges or user interaction, with high impact on availability and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing application-layer protections such as input validation and web application firewalls as temporary mitigations. Monitor for any updates from the vendor regarding official fixes.