CVE-2026-111871: SQL Injection in Online-Examination-System's subjectsdb.php

Overview

CVE-2026-111871 is a SQL injection vulnerability in itsmeravitejak's Online-Examination-System, an open-source PHP exam-management project, affecting commits up to and including e6208e630b14657999bbfe4c9912302d2a1e2449. The flaw carries a CVSS 3.1 score of 7.3 (High), was published October 18, 2026, and is classified under CWE-89 (SQL Injection) and CWE-74 (Injection).

This is the first of three related SQL injection advisories disclosed against the same codebase on the same day — see also CVE-2026-111872 and CVE-2026-111873. All three were filed as separate GitHub issues (#5, #6, and #7 respectively) against the project repository and reported by VulDB.

The vulnerable code is an unnamed function inside qsdb/usersdb/brandb/topicsdb/subjectsdb.php, reachable through the query, qtype, sortname, and sortorder arguments. Multiple sortable, filterable parameters feeding directly into a query — a common pattern in admin list/grid views — is a frequent source of this class of bug when sort/filter values are concatenated into SQL rather than validated against an allowlist of column names and directions.

Technical Details

How It Works

The affected file path (qsdb/usersdb/brandb/topicsdb/subjectsdb.php) suggests a database-listing endpoint for subjects within the exam system's admin interface, supporting search (query), result-type filtering (qtype), and column sorting (sortname/sortorder). Sort-direction and sort-column parameters are a classic injection vector because developers often assume they only ever contain values like ASC/DESC or a known column name — and then skip parameterization on the (mistaken) assumption that user input can't reach a dangerous position in the query string. NVD's description confirms that manipulation of any of the four listed parameters can trigger SQL injection, with the attack launchable remotely and without authentication.

Impact Assessment

Recommendations

For Online-Examination-System operators

1. Treat this as part of a systemic issue, not an isolated fix. Review all three related advisories (CVE-2026-111871, -111872, -111873) together — they point to the same root-cause pattern across different files.
2. Replace string-concatenated SQL with parameterized queries or prepared statements across subjectsdb.php and any file handling sortname/sortorder-style parameters.
3. Allowlist sort columns and directions explicitly rather than passing user-supplied values into the query.
4. Restrict network exposure of admin/listing endpoints behind authentication and a reverse proxy while awaiting a verified fix, given this project uses a rolling release model with no discrete version numbers.

For security teams

1. Deploy a WAF rule targeting common SQL injection patterns in sort/filter parameters if this software is in use and cannot be immediately patched.
2. Audit database logs for anomalous queries referencing sortname or sortorder values outside expected column names.

Key Takeaways

1. CVE-2026-111871 is a CVSS 7.3 High SQL injection in subjectsdb.php, exploitable via the query, qtype, sortname, and sortorder parameters.
2. It is one of three related SQL injection CVEs (alongside CVE-2026-111872 and CVE-2026-111873) disclosed the same day against itsmeravitejak's Online-Examination-System.
3. The flaw is remotely exploitable with no authentication or user interaction.
4. The pattern across all three CVEs points to a systemic lack of parameterized queries, not a single isolated bug.
5. The project's rolling release model means there are no discrete affected/fixed versions — track exposure by commit hash.

Sources

• NVD — CVE-2026-111871
• GitHub — itsmeravitejak/Online-Examination-System

See also: CVE-2026-111872 and CVE-2026-111873, two related SQL injection flaws in the same project.