{"id":"CVE-2026-111873","kind":"vulnerability","aliases":["CVE-2026-111873"],"related":[],"title":"Online-Examination-System: SQL injection in topicslist AJAX endpoint via subject argument","description":"A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The exammanger.php AJAX endpoint passes the subject parameter into a SQL query in MySQLDB::topicslist without proper sanitization. A remote attacker can inject SQL to read or alter the application's database, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","online-examination-system","other","php","self-hosted"],"not_affected_if":["endpoint-blocked","not-deployed"],"how_to_check":"- Check whether the deployment includes exammanger.php and the MySQLDB::topicslist function from itsmeravitejak Online-Examination-System.\n- Compare the deployed commit against e6208e630b14657999bbfe4c9912302d2a1e2449, which the sources list as affected; the project is rolling release with no version numbers.","fix":"- unknown: no fixed release or patched commit is named in the sources, and the project has not responded to the report.\n- Until a fix exists, restrict access to exammanger.php at the web server or block it from the internet.","status":"open","published_at":"2026-10-18T05:16:27+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:23:35+00:00","updated_at":"2026-10-25T03:23:35+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:23:35Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: no fixed release or patched commit is named in the sources, and the project has not responded to the report.\n- Until a fix exists, restrict access to exammanger.php at the web server or block it from the internet.","reach":"internet","title":"Online-Examination-System: SQL injection in topicslist AJAX endpoint via subject argument","impact":"high","summary":"The exammanger.php AJAX endpoint passes the subject parameter into a SQL query in MySQLDB::topicslist without proper sanitization. A remote attacker can inject SQL to read or alter the application's database, and a public exploit exists.","category":"other","nicknames":[],"who_cares":["online-examination-system","php","mysql","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs SQL against the database, reading or changing exam and user data.","analyst_note":"Find the upstream repository's fix status and whether exammanger.php requires login; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111873 for CVSS vector details.","how_to_check":"- Check whether the deployment includes exammanger.php and the MySQLDB::topicslist function from itsmeravitejak Online-Examination-System.\n- Compare the deployed commit against e6208e630b14657999bbfe4c9912302d2a1e2449, which the sources list as affected; the project is rolling release with no version numbers.","needs_analyst":true,"not_affected_if":["not-deployed","endpoint-blocked"],"who_is_affected":"Any deployment of itsmeravitejak Online-Examination-System at or before commit e6208e630b14657999bbfe4c9912302d2a1e2449 that serves exammanger.php to the network is exposed, since the flaw is reachable remotely through the AJAX endpoint. Teams that do not run this project, or run a version that does not include this file, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":3433,"output_tokens":696,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111873':16A,19A '-2026':15A,18A 'affect':139C 'ajax':9A,32B,93C 'alter':57B 'applic':59B 'argument':13A,99C 'attack':50B,106C 'basi':127C 'compon':92C 'consequ':131C 'continu':129C 'cve':14A,17A 'databas':61B 'deliveri':130C 'detail':136C 'detect':70C 'e6208e630b14657999bbfe4c9912302d2a1e2449':79C 'earli':150C 'either':138C 'endpoint':10A,33B,94C 'ensur':128C 'examin':3A,23B,75C 'exammanger.php':31B,89C 'exist':66B 'exploit':65B,112C 'file':88C 'function':83C 'host':29B 'impact':81C 'inform':146C 'inject':6A,52B,104C 'issu':153C 'itsmeravitejak':72C 'launch':109C 'manipul':96C 'may':107C,117C 'mysql':20B 'mysqldb':43B,84C 'onlin':2A,22B,74C 'online-examination-system':1A,21B,73C 'oper':122C 'paramet':37B 'pass':34B 'php':26B 'problem':149C 'product':121C 'project':144C 'proper':46B 'public':64B,115C 'queri':41B 'read':55B 'releas':126C,142C 'remot':49B,110C 'report':154C 'respond':158C 'result':101C 'roll':125C 'sanit':47B 'self':28B 'self-host':27B 'sql':5A,40B,53B,103C 'subject':12A,36B,100C 'system':4A,24B,76C 'topicslist':8A,44B,85C 'updat':141C 'use':119C 'version':135C 'via':11A 'vulner':68C 'without':45B 'yet':159C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of itsmeravitejak Online-Examination-System at or before commit e6208e630b14657999bbfe4c9912302d2a1e2449 that serves exammanger.php to the network is exposed, since the flaw is reachable remotely through the AJAX endpoint. Teams that do not run this project, or run a version that does not include this file, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T05:16:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111873","severity":null,"published_at":"2026-10-18T05:16:27+00:00","modified_at":"2026-10-22T03:16:31+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}