A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute arbitrary SQL comman…

A SQL injection vulnerability has been discovered in the Kashipara Online Exam System V1.0, specifically in the /exam/user/profile.php page. The vulnerability allows remote attackers to execute arbitrary SQL commands and gain unauthorized database access. The attack vector involves manipulating multiple parameters (rname, rcollage, rnumber, rgender, rpassword) through POST HTTP requests. This vulnerability affects the user profile update functionality and could lead to complete database compromise. The issue has been assigned CVE-2025-51567 and represents a critical security flaw in the educational software platform.