{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/online-exam-system-1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sourcecodester:online_exam_system:1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-109607"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Online Exam System (1.0)"],"_cs_severities":["high"],"_cs_tags":["sql-injection","vulnerability","webserver"],"_cs_type":"threat","_cs_vendors":["SourceCodester"],"content_html":"\u003cp\u003eA critical SQL injection vulnerability, identified as CVE-2026-109607, exists in the SourceCodester Online Exam System version 1.0. The vulnerability resides within the 'adminpanel/admin/query/loginExe.php' file, which serves as the login endpoint for the administrative interface. An unauthenticated remote attacker can supply malicious input via the 'username' or 'password' parameters to manipulate backend SQL queries. Successful exploitation allows an attacker to bypass authentication mechanisms or extract sensitive information from the underlying database. The vulnerability is publicly disclosed, and proof-of-concept exploit code is available, increasing the risk of active exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability affects instances of SourceCodester Online Exam System 1.0. If exploited, an attacker gains unauthorized access to the administrative panel, potentially leading to a full compromise of the examination system, exposure of student and staff PII, and unauthorized modification of exam data. Organizations utilizing this software face elevated risk of data breach and integrity loss.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePerform a security audit of all deployments of SourceCodester Online Exam System to identify and decommission version 1.0.\u003c/li\u003e\n\u003cli\u003eImplement Web Application Firewall (WAF) rules to detect and block SQL injection patterns specifically targeting '/adminpanel/admin/query/loginExe.php'.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests to the login endpoint involving shell metacharacters or SQL syntax in the 'username' and 'password' fields.\u003c/li\u003e\n\u003cli\u003eReplace the vulnerable application with a supported, secure alternative, as no vendor patch is currently available for this legacy version.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T18:36:56Z","date_published":"2026-10-13T18:36:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-109607/","summary":"SourceCodester Online Exam System 1.0 is vulnerable to unauthenticated remote SQL injection via the login endpoint, allowing potential authentication bypass.","title":"SQL Injection Vulnerability in SourceCodester Online Exam System","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-109607/"}],"language":"en","title":"CraftedSignal Threat Feed - Online Exam System (1.0)","version":"https://jsonfeed.org/version/1.1"}