CVE-2026-111870
Received Received - Intake

Authentication Bypass in itsmeravitejak Online-Examination-System

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description
A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-111870
EUVD
EUVD-2026-103381

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Online Examination System where multiple admin data endpoints lack proper authentication. These endpoints, including qsdb.php, usersdb.php, and admin.php, expose sensitive data like exam questions, user emails, and admin UI to unauthenticated users. The root cause is missing session checks or role verification, allowing attackers to access data via direct HTTP requests. Additionally, these endpoints are vulnerable to SQL injection, further increasing data exposure risks.

Detection Guidance

Check for unauthenticated access to admin endpoints like admin.php, qsdb.php, usersdb.php, brandb.php, topicsdb.php, and subjectsdb.php by sending direct HTTP requests. Look for exposed sensitive data such as exam questions, user emails, or admin UI without login. Test for SQL injection in these endpoints.

  • Use curl to access endpoints: curl http://<target>/admin/admin.php, curl http://<target>/qsdb.php, curl http://<target>/usersdb.php
  • Check for default admin credentials (admin:123456) or missing authentication headers in responses.
Impact Analysis

Attackers can remotely access sensitive information such as exam questions, user emails, and admin interfaces without authentication. This could lead to data breaches, unauthorized exam modifications, or exposure of personal user data. The public availability of an exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data (user emails) and HIPAA if exam-related health data is exposed. Non-compliance risks include fines, legal penalties, and reputational damage for organizations using this system.

Mitigation Strategies

Immediately restrict access to affected endpoints by implementing authentication checks. Update the admin.php file to include session validation or role verification. Disable direct access to sensitive files like qsdb.php and usersdb.php until proper access controls are enforced.

  • Apply input validation and parameterized queries to prevent SQL injection in all database-related endpoints.
  • Change default admin credentials and enforce strong password policies for all users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111870. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart