CVE-2026-103116
MediumCVSS 6.3Summary
SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. The DBQuery function in functions/GetStuListFnc.php of the Student List Search Endpoint component allows manipulation of the LO_sort argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
SQL Injection can allow an attacker to gain unauthorized access to student data or other database information.
Recommendation
Update openSIS-Classic to a patched version or use parameterized queries.
Other vulnerabilities in OS4ED openSIS-Classic
See all- CVE-2026-103117Medium
SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. The db_properties function in functions/DatabaseInc.php of the Save Data Handler component allows manipulation of the values argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-103115Medium
SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. An unknown function in functions/CustomFieldsFnc.php of the Student Search component allows manipulation of the cust argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-103114Medium
SQL injection vulnerability in OS4ED openSIS-Classic up to 9.3. The function DBQuery_assignment in file modules/grades/Assignments.php (component Assignment Management Endpoint) allows manipulation of the argument Tables, enabling remote attack. Exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS