| शीर्षक | itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 SQL Injection |
|---|
| विवरण | The affected component is `exam.php`, which starts an exam for any logged-in user (registration is open). The POST parameter `topicid` flows into `Exam::startExam()` in `include/exam.php` and then into `MySQLDB::isdreqs()` and `MySQLDB::getranqarray()` in `include/database.php`, where it is concatenated into SQL statements without quoting or validation:
```php
$res=$this->query('select count(*) from '.TBL_QUESTIONS.' where top_id='.$topid);
$res=$this->query('select q_id from '.TBL_QUESTIONS.' where top_id='.$topid);
```
The injection is boolean-based in the first query: `topicid=1 AND 1=1` starts the exam (the page renders "Topic: osi reference model"), while `topicid=1 AND 1=2` makes `isdreqs()` fail and the page prints "there are not as many questions as you asked". Because the injected `q_id` values returned by `getranqarray()` are stored in `$_SESSION['currentqarray']` and later concatenated into further queries in `loadQuestion()`/`loadans()`, the parameter also enables second-order injection. Any student account (e.g. one created through the public registration form) can exploit it.
|
|---|
| स्रोत | ⚠️ https://github.com/itsmeravitejak/Online-Examination-System/issues/8 |
|---|
| उपयोगकर्ता | Stjorn (UID 101834) |
|---|
| सबमिशन | 30/09/2026 05:29 PM (18 दिन पहले) |
|---|
| संयम | 18/10/2026 12:19 AM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 421657 [itsmeravitejak Online-Examination-System तक e6208e630b14657999bbfe4c9912302d2a1e2449 Exam exam.php Exam::startExam topicid SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|