CVE-2026-111992: SQL Injection in itsmeravitejak Online-Examination-System

This vulnerability involves SQL injection in the Exam::startExam function of the exam.php file in the Exam Module of the itsmeravitejak Online-Examination-System. Manipulation of the topicid parameter enables an attacker to inject SQL commands remotely. The product's rolling release model means version information for affected or patched releases is unavailable. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). The project was notified early but has not issued a response or patch. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to perform SQL injection via the topicid parameter, potentially leading to unauthorized data access or modification within the Online-Examination-System database. The vulnerability is remotely exploitable without user interaction and requires low attack complexity with low privileges. The presence of public exploit code increases the likelihood of exploitation. However, no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor the vendor's communications for updates. In the meantime, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the topicid parameter. Avoid exposing the vulnerable endpoint to untrusted networks if possible.