CVE-2020-37057 is a SQL injection in Online-Exam-System 2015, scored 8.2 (high). The fid parameter in the feedback module reaches a database query without safe handling. The record lists no fixed release, so keep the system off the public internet until the query is rewritten or the project is replaced.
What's affected
The record lists Online-Exam-System 2015 by sunnygkp10, a GitHub project. The vulnerable code is in the feedback module, and the parameter is fid.
The record says an attacker could extract, modify or delete database information. The CVSS vector is AV:N/AC:L/PR:N/UI:N, so no login is needed. No fixed version is named. The reference points to the repository itself.
How to check if you're exposed
There is no package to query. Check the deployment directly.
- Ask whether your school, training team or any student project hosts this application.
- Search code for the feedback module and any query that uses a variable named fid.
- Review access logs for feedback requests with unusual fid values.
- Confirm whether the host is reachable from the internet.
What to do now
- Find every running copy of the application.
- Remove public access or put it behind a login at the web server or VPN.
- Change the feedback query to use a prepared statement and cast fid to an integer.
- Audit the other modules for string built queries.
- Back up the database, and review exam and user data for signs of tampering.
Why it matters
The weakness is CWE-89, SQL injection. The application builds a database query by putting request data straight into the query text. The database cannot tell which part is the developer's instruction and which part came from the visitor, so crafted input can change what the query does.
Exam systems hold results and personal data about students, so changed or deleted records have real consequences. The record mentions modification and deletion as well as extraction, which makes integrity a concern beyond data theft.
The fix for this class is well understood. Use parameterized queries or prepared statements so that input is always treated as data, validate values against an allowlist where only a few are valid, and give the application database account only the rights it needs. None of this is complicated, but it has to be applied to every query in the code base, which is why one reported parameter is often a sign of others.
Quick check
What is fid?
It is the request parameter the feedback module uses to look up a record. The record does not describe what the identifier stands for beyond that.
Sources
Last reviewed: 19 October 2026.
