Testa Online Test Management System SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Testa Online Test Management System version 3.4.7. This vulnerability allows attackers to manipulate database queries by injecting malicious SQL code through the 'q' search parameter. Exploitation of this vulnerability could lead to unauthorized access to database information, including sensitive user or system data.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to manipulate database queries and access or modify database information. This could include extracting sensitive user or system data from the database.

Reproduction

To reproduce this vulnerability, log into the Testa Online Test Management System version 3.4.7. Navigate to the 'List And Search Exams' section. In the search field, inject a SQL payload, such as a UNION SELECT statement, to manipulate the database query and extract information.