Executive brief
A vulnerability exists in the Online Examination software, a web application used for managing academic tests. An attacker with teacher-level access can exploit this flaw to interfere with the database, potentially allowing them to view sensitive exam data or modify quiz records. This could compromise the integrity of the examination process and lead to unauthorized data exposure.
Technical details
A SQL injection vulnerability exists in code-projects Online Examination 1.0 within the 'Quiz Creation' component. The issue is located in the /update.php?q=addquiz endpoint, where user-supplied parameters including 'name', 'total', 'right', 'wrong', 'time', 'tag', and 'desc' are concatenated directly into a mysqli_query INSERT statement without sanitization or parameterization. An attacker with an authenticated teacher session (specifically requiring a valid session key) can exploit this via a crafted POST request. Successful exploitation, demonstrated via time-based blind SQL injection, allows for unauthorized database enumeration and data extraction.
Affected products
- code-projects Online Examination 1.0
Timeline
- 2026-07-05: advisory: Vulnerability published by NVD/VulDB