CVE-2026-103113 in openSIS-Classic
Summary
by MITRE • 09/30/2026
A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in OS4ED openSIS-Classic, specifically within version 9.3 and earlier releases, represents a critical security flaw located in the General Information Tab component. This defect is situated within the save action function of the Student.php file found in the modules/students directory. The core issue stems from improper input validation and sanitization mechanisms when processing data submitted through this interface. Specifically, the manipulation of the students argument allows an attacker to inject malicious SQL code into the backend database queries executed by the application. This type of flaw is classically categorized under CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The presence of this vulnerability indicates that user-supplied data is being concatenated directly into SQL statements without adequate filtering or parameterization, creating a direct pathway for unauthorized database interaction.
From an operational perspective, the impact of this vulnerability is severe due to its remote exploitability and public disclosure status. An attacker located remotely can leverage this flaw by crafting specific HTTP requests that contain malicious payloads within the students argument field. Because the exploit has been publicly disclosed, automated scanning tools and threat actors are likely already attempting to compromise systems running affected versions. Successful exploitation could lead to a range of detrimental outcomes including unauthorized access to sensitive student records, modification or deletion of database contents, and potentially full system compromise if the underlying database service runs with elevated privileges. The exposure of personally identifiable information (PII) such as names, addresses, dates of birth, and academic histories poses significant privacy risks and regulatory compliance issues for educational institutions relying on this software.
The attack vector aligns closely with MITRE ATT&CK technique T1190, which covers Exploit Public-Facing Application. This classification highlights the risk associated with applications that are accessible over a network and contain known vulnerabilities. The fact that the project maintainers have not yet responded to early issue reports exacerbates the risk profile for users of openSIS-Classic. Without an official patch or update from the developers, organizations must rely on alternative mitigation strategies to secure their deployments. This lack of vendor support places the burden of remediation squarely on system administrators and security teams responsible for maintaining these environments.
To mitigate this vulnerability in the absence of a direct software patch, several defensive measures should be implemented immediately. The most effective technical control is the deployment of a Web Application Firewall (WAF) configured with rules specifically designed to detect and block SQL injection patterns within HTTP request parameters. Additionally, input validation logic can be applied at the application layer by ensuring that all inputs are strictly typed and sanitized before being processed. Implementing parameterized queries or prepared statements in any custom code modifications is essential for long-term resilience against such flaws. Furthermore, organizations should consider isolating the openSIS-Classic instance within a restricted network segment to limit exposure to untrusted networks until an official fix becomes available. Regular monitoring of database logs for anomalous query patterns can also aid in early detection of exploitation attempts.