---
id: "CVE-2026-111873"
kind: "vulnerability"
aliases: ["CVE-2026-111873"]
title: "Online-Examination-System: SQL injection in topicslist AJAX endpoint via subject argument"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["mysql", "online-examination-system", "other", "php", "self-hosted"]
not_affected_if: ["endpoint-blocked", "not-deployed"]
published_at: "2026-10-18T05:16:27+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:23:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111873", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Online-Examination-System: SQL injection in topicslist AJAX endpoint via subject argument

The exammanger.php AJAX endpoint passes the subject parameter into a SQL query in MySQLDB::topicslist without proper sanitization. A remote attacker can inject SQL to read or alter the application's database, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment includes exammanger.php and the MySQLDB::topicslist function from itsmeravitejak Online-Examination-System.
- Compare the deployed commit against e6208e630b14657999bbfe4c9912302d2a1e2449, which the sources list as affected; the project is rolling release with no version numbers.

## Fix

- unknown: no fixed release or patched commit is named in the sources, and the project has not responded to the report.
- Until a fix exists, restrict access to exammanger.php at the web server or block it from the internet.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111873

## From the sources

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_