openSIS Classic vulnerabilities

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role to select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.

In OS4ED openSIS-Classic up to version 9.3, the save action function in modules/students/Student.php (General Information Tab component) is vulnerable to SQL injection via manipulation of the students argument. The attack can be performed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed but has not responded.

A path traversal vulnerability in the legacy messaging sent-mail attachment download functionality of openSIS Classic 9.3 allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.