CVE-2026-103115
MediumCVSS 6.3Summary
SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. An unknown function in functions/CustomFieldsFnc.php of the Student Search component allows manipulation of the cust argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
SQL Injection can allow an attacker to gain unauthorized access to student data or other database information.
Recommendation
Update openSIS-Classic to a patched version or use parameterized queries.
Other vulnerabilities in OS4ED openSIS-Classic
See all- CVE-2026-103117Medium
SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. The db_properties function in functions/DatabaseInc.php of the Save Data Handler component allows manipulation of the values argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-103116Medium
SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. The DBQuery function in functions/GetStuListFnc.php of the Student List Search Endpoint component allows manipulation of the LO_sort argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-103114Medium
SQL injection vulnerability in OS4ED openSIS-Classic up to 9.3. The function DBQuery_assignment in file modules/grades/Assignments.php (component Assignment Management Endpoint) allows manipulation of the argument Tables, enabling remote attack. Exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS