CVE-2026-103115 in openSIS-Classic
Summary
by MITRE • 09/30/2026
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified within OS4ED openSIS-Classic versions up to 9.3 represents a critical security deficiency located in the Student Search component, specifically affecting the CustomFieldsFnc.php file. This flaw is categorized as SQL injection, which corresponds to CWE-89 in the Common Weakness Enumeration standard. The root cause lies in the improper handling of user-supplied input within an unknown function that processes the cust argument. When this parameter is manipulated by an attacker, it allows for the construction of malicious SQL queries that bypass intended logic controls. This type of vulnerability typically arises from a failure to properly sanitize or parameterize database inputs before they are executed against the backend data store, allowing special characters and SQL syntax to be interpreted as executable code rather than literal data values.
The operational impact of this flaw is severe due to its remote exploitability. An attacker can launch attacks over the network without requiring prior authentication in many configurations involving student search functionalities, or with minimal privileges if such access exists. The availability of public exploits significantly lowers the barrier for entry, enabling individuals with varying levels of technical expertise to compromise the system. Successful exploitation could lead to unauthorized data disclosure, allowing attackers to extract sensitive information stored within the database, including personally identifiable information (PII) of students and staff. Furthermore, depending on the underlying database configuration and privileges granted to the application's database user, an attacker might achieve remote code execution or modify critical records, thereby compromising the integrity and confidentiality of the entire educational management system.
This incident aligns with several tactics in the MITRE ATT&CK framework, particularly those related to initial access and credential dumping via SQL injection techniques. The lack of response from the project maintainers despite early notification through an issue report exacerbates the risk landscape for existing deployments. Organizations relying on openSIS-Classic must treat this as a high-priority remediation item given the maturity of available exploits. Immediate mitigation strategies should include deploying web application firewalls configured to detect and block SQL injection patterns targeting the CustomFieldsFnc.php endpoint, although such controls are not substitutes for code-level fixes. Administrators should also enforce strict input validation on all client-side forms that submit data to this component and review database access permissions to ensure the principle of least privilege is applied, limiting potential damage in case of a successful breach until an official patch or version update addressing CWE-89 is released by the vendor.