CVE-2026-111871: SQL Injection in itsmeravitejak Online-Examination-System

This vulnerability in the itsmeravitejak Online-Examination-System allows remote attackers to perform SQL injection via manipulation of the query, qtype, sortname, or sortorder parameters in an unknown function within the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. The product lacks versioning, so specific affected versions are unknown. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The issue was reported to the project early, but no fix or response has been provided. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is provided, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the affected parameters. Restricting database permissions and input validation may also help mitigate risk.