CVE-2026-111872: SQL Injection in itsmeravitejak Online-Examination-System
Description
CVE-2026-111872 is a SQL injection vulnerability in the itsmeravitejak Online-Examination-System affecting multiple database-related functions in results.php/include/database.php. The vulnerability arises from manipulation of the id, user, or topic arguments, allowing remote attackers to inject SQL commands. The product uses a rolling release model, so specific affected versions are not clearly defined. The issue was reported early but remains unaddressed by the vendor. The CVSS 4.0 score rates this as medium severity.
CVSS v4.0
Score 6.9medium
Affected software
itsmeravitejak
Online-Examination-System
cpe:2.3:a:itsmeravitejak:online-examination-system:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in the itsmeravitejak Online-Examination-System involves SQL injection in the functions MySQLDB::valid, MySQLDB::getresults, MySQLDB::noresults, MySQLDB::getExams, MySQLDB::latestExamID, and MySQLDB::getreport within results.php/include/database.php. The flaw is triggered by manipulation of the id, user, or topic parameters, enabling remote attackers to execute arbitrary SQL queries. The product's rolling release model prevents precise version identification of affected releases. The vulnerability was disclosed publicly, and no vendor response or patch is currently available.
Potential Impact
Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The CVSS 4.0 score of 6.9 indicates a medium severity impact with low attack complexity and no required privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor for official updates. Until a fix is released, restricting access to vulnerable endpoints and employing web application firewalls with SQL injection detection may help mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-17T09:35:05.758Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad445332cdf04f65633e45b
Added to database: 10/18/2026, 04:04:03 UTC
Last enriched: 10/18/2026, 04:21:35 UTC
Last updated: 10/18/2026, 04:21:35 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.