CVE-2025-4686CWE-89

Time-Based Blind SQLi in Kodmatic Computer's Online Exam and Assessment

High · published January 30, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
26.6
In the wild
Unconfirmed
What it is

⚡ A sneaky SQL Injection vulnerability is lurking in Kodmatic's Online Exam and Assessment software, and it could leave your database wide open! 🔥 Think of it as a restaurant that accepts any order without checking for allergies — one wrong input could lead to a disastrous meal for every patron. If an attacker knows how to play the system, they can manipulate the database just like a chef who forgets to read the order ticket. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially accessing sensitive data, modifying records, or even deleting everything within the database. Imagine someone walking straight into the kitchen and cooking whatever they want, unhindered! The consequences could be absolutely devastating for user data security and trust.

Put simply

Think of it as a restaurant that accepts any order without checking for allergies — one wrong input could lead to a disastrous meal for every patron. If an attacker knows how to play the system, they can manipulate the database just like a chef who forgets to read the order ticket. This SQL Injection flaw allows attackers to input malicious SQL code through the Online Exam and Assessment platform, bypassing security controls and compromising the database's integrity.

What to do

An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially accessing sensitive data, modifying records, or even deleting everything within the database. Imagine someone walking straight into the kitchen and cooking whatever they want, unhindered! The consequences could be absolutely devastating for user data security and trust. It's crucial to patch your application to the latest version immediately and implement prepared statements to sanitize user input. Regularly audit your database queries to ensure that security measures are in place to prevent such vulnerabilities. Don't wait, take action now! You've got this! With a few simple steps, you can secure your system and earn your security hero badge! 🛡️

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00343 · 26.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-30T15:54Z
EPSS history
Timeline
  • 30 JAN 15:54Z
    Time-Based Blind SQLi in Kodmatic Computer's Online Exam and Assessment
    cvelistv5