CVE-2024-5116 is a high severity (CVSS 7.3) SQL injection in SourceCodester Online Examination System. The vote input handled by save.php reaches a database query unsafely. The record names no fixed version, so remove the application from exposure or patch the query yourself.
What's affected
The record lists SourceCodester Online Examination System (version 1.0) and says the flaw is in save.php, through the vote argument. The parameter name, vote, hints that the code was adapted from a polling script. Examination data such as answers and results is exactly what a tampering attacker would target.
The record gives no fixed version and no vendor patch, and the public write up was posted by an independent researcher. The identifier VDB-265196 is VulDB's tracking number. Sources of this kind describe projects distributed as learning or demo code, so a patch from the author may never arrive.
How to check if you're exposed
First find out whether you run this software at all. Search your web roots and repositories:
find /var/www -name 'save.php' 2>/dev/null
grep -rn "vote" /var/www --include=*.php | head
If the file is present, open it and look for the parameter being placed straight into a query string. Review web server logs for requests to this path that carry quote characters or SQL keywords in the parameter. A web application scan of a staging copy can confirm the behavior without touching production.
What to do now
- Take the exam app offline for exam periods if it cannot be patched first.
- Rewrite save.php with bound parameters.
- Compare stored results against any independent records, like emailed receipts, to detect tampering.
- Restrict the database user to inserts on the tables it needs.
- Add server side logging for every write to results tables.
- Run a dynamic scan of a staging copy after the fix.
Why it matters
SQL injection (CWE-89) happens when user input is concatenated into a query string, so the database cannot tell data from instructions. The result depends on database privileges and on what the query does: reading rows the page never meant to show, changing them, or in some setups reaching further. For an examination system the damaging outcome is not only data theft. Altered answers or scores undermine the whole purpose. Integrity checks outside the application give you a way to know if that happened.
The published description says the exploit has been disclosed to the public and may be used, so assume that anyone who looks can find the technique. The record does not set the KEV flag, so there is no CISA report of active exploitation in it.
Try it yourself
This demo shows a dynamic scan of a web application finding injectable inputs, the check to run after you patch.
Click through it at your own pace, or open it full screen.
Quick check
What is at risk beyond data theft?
Integrity of results. A write capable injection can change scores or answers.
Is there a vendor fix?
Not in the record.
Sources
Last reviewed: 19 October 2026.
