| Название | itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 SQL Injection |
|---|
| Описание | The affected component is `results.php`, which is reachable without authentication. Three request parameters are concatenated into SQL queries without any validation: the GET parameter `id` (used in `MySQLDB::valid()` and `MySQLDB::getresults()`), the GET parameter `user` (used in `MySQLDB::noresults()`, `MySQLDB::getExams()` and `MySQLDB::latestExamID()`), and the POST parameter `topic` (used in `MySQLDB::getreport()`), all defined in `include/database.php`:
```php
$res=$this->query('select count(*) from exam_res where exam_id='.$examid);
$res=$this->query('select count(*) from exam_res where username="'.$stdid.'"');
$res=$this->query('select * from exam_res where top_id='.$topicid.' ORDER BY username');
```
The `id` and `user` parameters yield boolean-based blind injection (e.g. `id=1 AND 1=1` shows the result page while `id=1 AND 1=2` shows "not a valid exam"), and the `topic` parameter yields in-band injection (rows from the whole `exam_res` table are printed into the HTML table when `topic=1 OR 1=1` is submitted). An unauthenticated attacker can dump or infer arbitrary data from the database.
|
|---|
| Источник | ⚠️ https://github.com/itsmeravitejak/Online-Examination-System/issues/6 |
|---|
| Пользователь | PrivacyFirst (UID 101731) |
|---|
| Представление | 29.09.2026 13:17 (18 дни назад) |
|---|
| Модерация | 17.10.2026 11:35 (18 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 421584 [itsmeravitejak Online-Examination-System до e6208e630b14657999bbfe4c9912302d2a1e2449 database.php getreport id/user/topic SQL-инъекция] |
|---|
| Баллы | 20 |
|---|