---
id: "CVE-2026-111871"
kind: "vulnerability"
aliases: ["CVE-2026-111871"]
title: "Online-Examination-System: SQL injection in query parameters lets remote attackers read database"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["online-examination-system", "package", "php", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-10-18T04:16:35+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:23:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111871", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Online-Examination-System: SQL injection in query parameters lets remote attackers read database

The Online-Examination-System project has an SQL injection flaw in the qsdb, usersdb, brandb, topicsdb and subjectsdb PHP endpoints, where the query, qtype, sortname and sortorder arguments reach SQL unsanitized. A remote attacker can manipulate those arguments to read or alter database contents, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment includes `qsdb/usersdb/brandb/topicsdb/subjectsdb.php` in the web root
- Compare the deployed commit against `e6208e630b14657999bbfe4c9912302d2a1e2449`; the project has no version numbers, and the sources say this commit and earlier are affected
- unknown whether the sources list a runtime check beyond this

## Fix

- unknown: the project has not responded to the report and no patched release is listed in the sources
- Restrict access to the five affected PHP files at the web server or remove them if unused
- Parameterize the query, qtype, sortname and sortorder inputs in those files if the code is maintained in-house

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111871

## From the sources

A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_