CVE-2026-111873: Public Exploit Available for Online-Examination-System AJAX SQL Injection

Overview

CVE-2026-111873 is a SQL injection vulnerability in itsmeravitejak's Online-Examination-System, affecting commits up to and including e6208e630b14657999bbfe4c9912302d2a1e2449. It carries a CVSS 3.1 score of 7.3 (High) and was published October 18, 2026, classified under CWE-89 (SQL Injection) and CWE-74 (Injection).

This is the third of three related SQL injection advisories disclosed the same day against this project — see also CVE-2026-111871 and CVE-2026-111872. It carries the highest practical urgency of the three: NVD's record states plainly that "the exploit is now public and may be used."

The flaw lives in MySQLDB::topicslist, a function in exammanger.php that backs an AJAX endpoint, and is triggered through the subject argument. AJAX endpoints are frequently overlooked in security review because they're not navigated to directly in a browser — but they are exactly as reachable by an attacker as any other HTTP endpoint, and this one requires no authentication.

Technical Details

How It Works

topicslist appears to return a filtered list of exam topics for a given subject, most likely called asynchronously from the exam-taking or exam-management interface to populate a dropdown or topic list without a full page reload. The subject value passed into this AJAX call is used to build a SQL query without adequate sanitization, letting an attacker supply crafted SQL instead of a legitimate subject identifier.

Because a working public exploit already exists, this is not a theoretical weakness — any internet-reachable deployment running an affected commit should be considered actively at risk of exploitation, not just vulnerable in principle.

Impact Assessment

Recommendations

For Online-Examination-System operators — act immediately

1. Assume active exploitation risk. A public exploit exists; do not wait for a confirmed patch before taking mitigating action.
2. Disable or firewall the exammanger.php AJAX endpoint from untrusted networks until the subject parameter is properly parameterized.
3. Rewrite MySQLDB::topicslist (and the other MySQLDB methods flagged in CVE-2026-111872) to use prepared statements.
4. Review web server and database logs for suspicious requests to exammanger.php containing SQL metacharacters in the subject parameter — exploitation attempts may have already occurred given the public exploit's availability.

For security teams

1. Prioritize this CVE above its two siblings for incident-response purposes specifically because of public exploit availability, even though all three share the same CVSS score.
2. Deploy a targeted WAF/IPS signature for the known exploit pattern against exammanger.php if available from your vendor.

Key Takeaways

1. CVE-2026-111873 is a CVSS 7.3 High SQL injection in the MySQLDB::topicslist function, reachable via the unauthenticated AJAX endpoint exammanger.php.
2. A public exploit is already available, making this the most urgent of the three related Online-Examination-System SQL injection CVEs disclosed October 18, 2026.
3. It is exploitable via the subject parameter, remotely, with no authentication or user interaction.
4. It is related to CVE-2026-111871 and CVE-2026-111872 — all three stem from the same project's lack of parameterized queries.
5. Operators should treat this as an active-exploitation risk, not a routine patch item, given the public exploit.

Sources

• NVD — CVE-2026-111873
• GitHub — itsmeravitejak/Online-Examination-System

See also: CVE-2026-111871 and CVE-2026-111872, two related SQL injection flaws in the same project.