| Título | itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 SQL Injection |
|---|
| Descrição | The affected component is `results.php`, which is reachable without authentication. Three request parameters are concatenated into SQL queries without any validation: the GET parameter `id` (used in `MySQLDB::valid()` and `MySQLDB::getresults()`), the GET parameter `user` (used in `MySQLDB::noresults()`, `MySQLDB::getExams()` and `MySQLDB::latestExamID()`), and the POST parameter `topic` (used in `MySQLDB::getreport()`), all defined in `include/database.php`:
```php
$res=$this->query('select count(*) from exam_res where exam_id='.$examid);
$res=$this->query('select count(*) from exam_res where username="'.$stdid.'"');
$res=$this->query('select * from exam_res where top_id='.$topicid.' ORDER BY username');
```
The `id` and `user` parameters yield boolean-based blind injection (e.g. `id=1 AND 1=1` shows the result page while `id=1 AND 1=2` shows "not a valid exam"), and the `topic` parameter yields in-band injection (rows from the whole `exam_res` table are printed into the HTML table when `topic=1 OR 1=1` is submitted). An unauthenticated attacker can dump or infer arbitrary data from the database.
|
|---|
| Fonte | ⚠️ https://github.com/itsmeravitejak/Online-Examination-System/issues/6 |
|---|
| Utilizador | PrivacyFirst (UID 101731) |
|---|
| Submissão | 29/09/2026 13h17 (há 18 dias) |
|---|
| Moderação | 17/10/2026 11h35 (18 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 421584 [itsmeravitejak Online-Examination-System até e6208e630b14657999bbfe4c9912302d2a1e2449 database.php getreport id/user/topic Injeção SQL] |
|---|
| Pontos | 20 |
|---|