CVE-2026-108970: itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Deployments of itsmeravitejak Online-Examination-System containing the vulnerable MySQLDB::addNewUser implementation in include/database.php are exposed through the Registration Form. The affected code is identified as being present up to commit e6208e630b14657999bbfe4c9912302d2a1e2449; release-version boundaries are not available because the project uses rolling releases.
Does exploitation require an account or user interaction?
No. The supplied severity vector indicates network-reachable exploitation with low attack complexity, no privileges, and no user interaction. An attacker manipulates the branch argument handled by the registration functionality.
Is public exploit code available?
Yes. The exploit is public and may be used, which increases the urgency of identifying exposed registration endpoints and applying an upstream remediation when one becomes available.
What can be done if an update is not available?
The available data does not identify a fixed release, and the project has not responded to the reported issue. As an interim measure, restrict or disable public access to the Registration Form where operationally feasible, since that is the affected component.