| शीर्षक | itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 SQL Injection |
|---|
| विवरण | The affected component is `results.php`, which is reachable without authentication. Three request parameters are concatenated into SQL queries without any validation: the GET parameter `id` (used in `MySQLDB::valid()` and `MySQLDB::getresults()`), the GET parameter `user` (used in `MySQLDB::noresults()`, `MySQLDB::getExams()` and `MySQLDB::latestExamID()`), and the POST parameter `topic` (used in `MySQLDB::getreport()`), all defined in `include/database.php`:
```php
$res=$this->query('select count(*) from exam_res where exam_id='.$examid);
$res=$this->query('select count(*) from exam_res where username="'.$stdid.'"');
$res=$this->query('select * from exam_res where top_id='.$topicid.' ORDER BY username');
```
The `id` and `user` parameters yield boolean-based blind injection (e.g. `id=1 AND 1=1` shows the result page while `id=1 AND 1=2` shows "not a valid exam"), and the `topic` parameter yields in-band injection (rows from the whole `exam_res` table are printed into the HTML table when `topic=1 OR 1=1` is submitted). An unauthenticated attacker can dump or infer arbitrary data from the database.
|
|---|
| स्रोत | ⚠️ https://github.com/itsmeravitejak/Online-Examination-System/issues/6 |
|---|
| उपयोगकर्ता | PrivacyFirst (UID 101731) |
|---|
| सबमिशन | 29/09/2026 01:17 PM (18 दिन पहले) |
|---|
| संयम | 17/10/2026 11:35 AM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 421584 [itsmeravitejak Online-Examination-System तक e6208e630b14657999bbfe4c9912302d2a1e2449 database.php getreport id/user/topic SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|