SQL Injection Vulnerabilities in Online Examination System Expose User Data

github.com

SQL Injection Vulnerabilities in Online Examination System Expose User Data

First seen 18 Oct 2026, 06:08 UTC •67.5

Article Content

1 / 3

Browse articles

ThreatCluster •October 18, 2026 at 06:38 UTC

•Two SQL injection vulnerabilities allow unauthorized data access.
•Vulnerabilities affect admin and results endpoints without authentication.
•Sensitive user data, including passwords and exam results, is at risk.

Two SQL injection vulnerabilities were identified in the Online Examination System, affecting its admin and results endpoints. The vulnerabilities allow unauthenticated attackers to extract sensitive data, including user credentials and exam results, through poorly validated input parameters. The first vulnerability, located in multiple admin data endpoints, enables attackers to execute arbitrary SQL queries via concatenated POST parameters. The second vulnerability in results.php permits boolean-based and in-band SQL injection through GET and POST parameters, also without authentication. Both issues were disclosed on October 18, 2026, and are linked to the same commit. The application is built on PHP 5.x but was tested on PHP 7.4, revealing compatibility issues. Immediate action is required to mitigate these vulnerabilities, as they pose a significant risk to user data integrity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-18

SQL injection vulnerabilities disclosed

Two critical SQL injection vulnerabilities were reported in the Online Examination System, enabling data extraction without authentication.

2026-10-18

Second SQL injection vulnerability disclosed

Another SQL injection vulnerability was identified in results.php, allowing unauthorized access to exam results.

More articles in this cluster (2)

Threat Graph

5 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Sql Injection
T1190 - Exploit Public-Facing Application

Weakness (1)

CWE-89 - SQL Injection

Affected Platform (2)

MySQL
PHP

Relationships

Sql Injection targets MySQL
Sql Injection targets PHP
T1190 - Exploit Public-Facing Application targets MySQL
T1190 - Exploit Public-Facing Application targets PHP
Sql Injection related to CWE-89 - SQL Injection

Common questions

What endpoints are affected?

The vulnerabilities affect the admin data endpoints and results.php, allowing SQL injection through various parameters.

Is there a patch available?

The articles do not mention any patches; immediate remediation is advised to secure the system.

What data can be accessed through these vulnerabilities?

Attackers can potentially access sensitive user data, including password hashes and exam results.

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…