SECURITYHIGHCVE-2026-111872

CVE-2026-111872: SQL Injection in Online-Examination-System's Database Layer

CVSS 7.3 SQL injection across MySQLDB::getreport and related functions in Online-Examination-System via id, user, and topic parameters.

Dylan H.

Security Team

October 18, 2026
4 min read
CVE-2026-111872: SQL Injection in Online-Examination-System's Database Layer

Affected Products

  • itsmeravitejak Online-Examination-System — commits up to and including e6208e630b14657999bbfe4c9912302d2a1e2449

Overview

CVE-2026-111872 is a SQL injection vulnerability in itsmeravitejak's Online-Examination-System, affecting commits up to and including e6208e630b14657999bbfe4c9912302d2a1e2449. It carries a CVSS 3.1 score of 7.3 (High), was published October 18, 2026, and is classified under CWE-89 (SQL Injection) and CWE-74 (Injection).

This is the second of three related SQL injection advisories disclosed the same day against this project — see also CVE-2026-111871 and CVE-2026-111873. Unlike the other two, which each point to a single vulnerable file, this CVE spans multiple functions across the database interaction layer: MySQLDB::valid, MySQLDB::getresults, MySQLDB::noresults, MySQLDB::getExams, MySQLDB::latestExamID, and MySQLDB::getreport, located in results.php and include/database.php. The flaw is triggered through the id, user, and topic arguments.

A vulnerability spanning six separate methods in a shared database class strongly suggests the class itself builds queries through string concatenation as a general pattern, rather than failing to sanitize input in one isolated function.

Technical Details

AttributeValue
CVE IDCVE-2026-111872
SeverityHigh
CVSS v3.1 Score7.3
CWECWE-89 (SQL Injection) / CWE-74 (Injection)
Projectitsmeravitejak / Online-Examination-System
Vulnerable Componentresults.php, include/database.php
Vulnerable FunctionsMySQLDB::valid, MySQLDB::getresults, MySQLDB::noresults, MySQLDB::getExams, MySQLDB::latestExamID, MySQLDB::getreport
Vulnerable Parametersid, user, topic
Affected RevisionsUp to and including commit e6208e630b14657999bbfe4c9912302d2a1e2449
Attack VectorNetwork, low attack complexity, no privileges or user interaction required
Related CVEsCVE-2026-111871, CVE-2026-111873 (same project, same disclosure date)
Reported ByVulDB, via GitHub issue #6
SourceNVD

How It Works

The MySQLDB class appears to be the project's central database-access helper, with each affected method responsible for a distinct piece of exam-results logic: validating a session/user (valid), pulling result sets (getresults, noresults), retrieving exam metadata (getExams, latestExamID), and generating report output (getreport). The id, user, and topic values that drive these lookups appear to be passed directly into SQL statements without parameterization, letting an attacker alter the intended query logic by supplying crafted values for any of the three parameters.

Because getreport and getresults likely power user-facing exam-result pages, this class of bug is reachable by any user capable of requesting a results or report view — a wide, easily-discoverable attack surface compared to an internal admin-only function.

Impact Assessment

Impact AreaDescription
ConfidentialityExam results, scores, and potentially other students' or staff accounts' data are at risk of exposure through injected queries against id/user/topic
IntegrityDepending on query context, injected SQL in a results/report path could tamper with stored scores or exam metadata
AvailabilityMalformed injected queries can degrade or crash exam-result retrieval
BreadthSix vulnerable functions across two files in a shared database class indicate the issue is systemic to how the class builds queries, not isolated to one code path

Recommendations

For Online-Examination-System operators

  1. Rewrite the MySQLDB class to use parameterized queries or prepared statements for every method listed above — patching one function without addressing the shared pattern will leave the others exploitable.
  2. Validate id, user, and topic as strict types (e.g., integers for IDs) before they reach any database call.
  3. Review all three related advisories together (CVE-2026-111871, CVE-2026-111872, CVE-2026-111873) — they describe the same underlying weakness across different files.
  4. Restrict or monitor access to exam-results and report endpoints while awaiting a verified fix.

For security teams

  1. Deploy WAF rules targeting SQL injection patterns in id, user, and topic request parameters if this software cannot be patched immediately.
  2. Audit exam-results and reporting database logs for anomalous query patterns.

Key Takeaways

  1. CVE-2026-111872 is a CVSS 7.3 High SQL injection spanning six functions in the MySQLDB database class, exploitable via id, user, and topic.
  2. It is one of three related SQL injection CVEs disclosed the same day against itsmeravitejak's Online-Examination-System.
  3. The breadth of affected functions suggests a systemic query-construction weakness, not a single isolated bug.
  4. The vulnerable code sits behind exam-results and reporting features, making it broadly reachable to any user who can request those views.
  5. All three related CVEs (CVE-2026-111871, CVE-2026-111872, CVE-2026-111873) should be remediated as a single engineering effort.

Sources

See also: CVE-2026-111871 and CVE-2026-111873, two related SQL injection flaws in the same project.