CVE-2026-111872 is a high severity (CVSS 7.3) SQL injection in itsmeravitejak Online-Examination-System up to commit e6208e6. The flaw affects results.php and the database class that backs it. The project has no versions and no confirmed fix, and the record says a public exploit exists, so keep it off public networks.
What's affected
Online-Examination-System up to commit e6208e630b14657999bbfe4c9912302d2a1e2449, per the record. The record says the project has no versioning and uses a rolling release model, and that the maintainer was told early through an issue report but had not responded. No fixed commit was confirmed.
The record names results.php and the MySQLDB class in include/database.php, in the functions valid, getresults, noresults, getExams, latestExamID and getreport. The manipulated arguments are id, user and topic. The record also says attacks can be launched remotely and that exploit details are public.
How to check if you're exposed
Find out which commit your copy was built from with git log. Anything up to e6208e6 is affected, and because there are no releases you cannot rely on a version number.
Review web server logs for requests to the named files with unusual characters in the listed parameters. If the app holds student or staff data, treat unexplained requests as a possible data breach and follow your own incident process.
What to do now
- Locate every running copy of the application.
- Remove it from public networks, or put it behind a VPN or an authenticating proxy.
- Back up the database and review it for unexpected changes.
- Rotate the database account password and any credentials stored in the database.
- If you maintain a fork, replace string built queries with prepared statements and validate each parameter.
- Consider a maintained exam platform if the project stays silent.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Do not stop at one host. Write down every place the affected software runs, including test servers, forgotten containers and copies bundled inside other products. Then rank them by exposure: anything reachable from the internet comes first, internal systems next. A short inventory now saves hours when the next advisory lands.
Why it matters
This is CWE-89, SQL injection, with CWE-74, injection in general, also listed. Request values are placed into SQL text, so a crafted value can change what the query does instead of being treated as data.
This looks like a learning project that has been copied into real settings. Unmaintained code with public exploit details and no maintainer response leaves operators to protect themselves. The same project has several related reports, so fixing one query is unlikely to be enough. It is not listed in CISA KEV.
Quick check
Is there a fixed version?
The record says the project has no versioning and that the maintainer had not responded. Plan to mitigate on your own.
Why remove public access?
The record says the attack works remotely and exploit details are public.
Sources
Last reviewed: 18 October 2026.
