| Titre | itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 SQL Injection |
|---|
| Description | The affected component is `results.php`, which is reachable without authentication. Three request parameters are concatenated into SQL queries without any validation: the GET parameter `id` (used in `MySQLDB::valid()` and `MySQLDB::getresults()`), the GET parameter `user` (used in `MySQLDB::noresults()`, `MySQLDB::getExams()` and `MySQLDB::latestExamID()`), and the POST parameter `topic` (used in `MySQLDB::getreport()`), all defined in `include/database.php`:
```php
$res=$this->query('select count(*) from exam_res where exam_id='.$examid);
$res=$this->query('select count(*) from exam_res where username="'.$stdid.'"');
$res=$this->query('select * from exam_res where top_id='.$topicid.' ORDER BY username');
```
The `id` and `user` parameters yield boolean-based blind injection (e.g. `id=1 AND 1=1` shows the result page while `id=1 AND 1=2` shows "not a valid exam"), and the `topic` parameter yields in-band injection (rows from the whole `exam_res` table are printed into the HTML table when `topic=1 OR 1=1` is submitted). An unauthenticated attacker can dump or infer arbitrary data from the database.
|
|---|
| La source | ⚠️ https://github.com/itsmeravitejak/Online-Examination-System/issues/6 |
|---|
| Utilisateur | PrivacyFirst (UID 101731) |
|---|
| Soumission | 29/09/2026 13:17 (il y a 18 jours) |
|---|
| Modérer | 17/10/2026 11:35 (18 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 421584 [itsmeravitejak Online-Examination-System database.php getreport id/user/topic injection SQL] |
|---|
| Points | 20 |
|---|