{"id":"CVE-2026-111871","kind":"vulnerability","aliases":["CVE-2026-111871"],"related":[],"title":"Online-Examination-System: SQL injection in query parameters lets remote attackers read database","description":"A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The Online-Examination-System project has an SQL injection flaw in the qsdb, usersdb, brandb, topicsdb and subjectsdb PHP endpoints, where the query, qtype, sortname and sortorder arguments reach SQL unsanitized. A remote attacker can manipulate those arguments to read or alter database contents, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["online-examination-system","package","php","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check whether the deployment includes `qsdb/usersdb/brandb/topicsdb/subjectsdb.php` in the web root\n- Compare the deployed commit against `e6208e630b14657999bbfe4c9912302d2a1e2449`; the project has no version numbers, and the sources say this commit and earlier are affected\n- unknown whether the sources list a runtime check beyond this","fix":"- unknown: the project has not responded to the report and no patched release is listed in the sources\n- Restrict access to the five affected PHP files at the web server or remove them if unused\n- Parameterize the query, qtype, sortname and sortorder inputs in those files if the code is maintained in-house","status":"open","published_at":"2026-10-18T04:16:35+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:23:37+00:00","updated_at":"2026-10-25T03:23:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:23:37Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the project has not responded to the report and no patched release is listed in the sources\n- Restrict access to the five affected PHP files at the web server or remove them if unused\n- Parameterize the query, qtype, sortname and sortorder inputs in those files if the code is maintained in-house","reach":"internet","title":"Online-Examination-System: SQL injection in query parameters lets remote attackers read database","impact":"high","summary":"The Online-Examination-System project has an SQL injection flaw in the qsdb, usersdb, brandb, topicsdb and subjectsdb PHP endpoints, where the query, qtype, sortname and sortorder arguments reach SQL unsanitized. A remote attacker can manipulate those arguments to read or alter database contents, and a public exploit exists.","category":"package","nicknames":[],"who_cares":["php","self-hosted","online-examination-system"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Database contents readable and modifiable by remote unauthenticated attacker","analyst_note":"No vendor response and no fixed version; check the NVD entry and the upstream repository issue for any patch or workaround, and confirm whether authentication is required.","how_to_check":"- Check whether the deployment includes `qsdb/usersdb/brandb/topicsdb/subjectsdb.php` in the web root\n- Compare the deployed commit against `e6208e630b14657999bbfe4c9912302d2a1e2449`; the project has no version numbers, and the sources say this commit and earlier are affected\n- unknown whether the sources list a runtime check beyond this","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Any deployment of the Online-Examination-System project at or before commit e6208e630b14657999bbfe4c9912302d2a1e2449 that exposes the affected PHP files to the network is exposed. The sources do not say whether authentication or a non-default configuration is needed, so the exposed path should be treated as reachable until checked.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":3421,"output_tokens":727,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111871':17A,20A '-2026':16A,19A 'affect':149C 'alter':72B 'argument':58B,68B,110C 'attack':12A,64B,118C,137C 'avail':128C 'brandb':45B 'content':74B 'could':133C 'cve':15A,18A 'databas':14A,73B 'e6208e630b14657999bbfe4c9912302d2a1e2449':93C 'earli':162C 'element':96C 'endpoint':50B 'examin':3A,23B,33B,89C 'execut':105C 'exist':79B 'exploit':78B,124C 'file':103C 'flaw':40B 'function':100C 'host':29B 'identifi':84C 'impact':95C 'inform':147C,158C 'inject':6A,39B,116C 'issu':165C 'itsmeravitejak':86C 'launch':121C 'lead':113C 'let':10A 'made':127C 'manipul':66B,107C 'onlin':2A,22B,32B,88C 'online-examination-system':1A,21B,31B,87C 'packag':25B 'paramet':9A 'php':26B,49B 'problem':161C 'product':139C 'project':35B,156C 'public':77B,131C 'qsdb':43B 'qsdb/usersdb/brandb/topicsdb/subjectsdb.php':104C 'qtype':54B 'queri':8A,53B 'query/qtype/sortname/sortorder':111C 'reach':59B 'read':13A,70B 'releas':152C 'remot':11A,63B,122C 'report':166C 'respond':170C 'self':28B 'self-host':27B 'sortnam':55B 'sortord':57B 'sql':5A,38B,60B,115C 'subjectsdb':48B 'system':4A,24B,34B,90C 'topicsdb':46B 'unaffect':151C 'unavail':154C 'unknown':99C 'unsanit':61B 'use':135C,142C 'usersdb':44B 'version':143C 'weak':81C 'yet':171C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of the Online-Examination-System project at or before commit e6208e630b14657999bbfe4c9912302d2a1e2449 that exposes the affected PHP files to the network is exposed. The sources do not say whether authentication or a non-default configuration is needed, so the exposed path should be treated as reachable until checked.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T04:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111871","severity":null,"published_at":"2026-10-18T04:16:35+00:00","modified_at":"2026-10-19T17:17:04+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}