SQL Injection Vulnerability in SourceCodester Online Exam System

A critical SQL injection vulnerability, identified as CVE-2026-109607, exists in the SourceCodester Online Exam System version 1.0. The vulnerability resides within the 'adminpanel/admin/query/loginExe.php' file, which serves as the login endpoint for the administrative interface. An unauthenticated remote attacker can supply malicious input via the 'username' or 'password' parameters to manipulate backend SQL queries. Successful exploitation allows an attacker to bypass authentication mechanisms or extract sensitive information from the underlying database. The vulnerability is publicly disclosed, and proof-of-concept exploit code is available, increasing the risk of active exploitation.

Impact

The vulnerability affects instances of SourceCodester Online Exam System 1.0. If exploited, an attacker gains unauthorized access to the administrative panel, potentially leading to a full compromise of the examination system, exposure of student and staff PII, and unauthorized modification of exam data. Organizations utilizing this software face elevated risk of data breach and integrity loss.

Recommendation

• Perform a security audit of all deployments of SourceCodester Online Exam System to identify and decommission version 1.0.
• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns specifically targeting '/adminpanel/admin/query/loginExe.php'.
• Monitor web server access logs for anomalous POST requests to the login endpoint involving shell metacharacters or SQL syntax in the 'username' and 'password' fields.
• Replace the vulnerable application with a supported, secure alternative, as no vendor patch is currently available for this legacy version.