CVE-2026-103116 in openSIS-Classic
Summary
by MITRE • 09/30/2026
A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The identified vulnerability resides within OS4ED openSIS-Classic, specifically affecting versions up to 9.3, in the Student List Search Endpoint component. This security flaw is located in the DBQuery function found within the file functions/GetStuListFnc.php. The core issue stems from a failure to properly sanitize user-supplied input before it is incorporated into SQL commands. Specifically, the LO_sort argument, which dictates how student records are sorted during search operations, is processed without adequate validation or parameterization. This oversight allows an attacker to inject malicious SQL code directly into the query structure, fundamentally compromising the integrity of database interactions and bypassing intended access controls.
This vulnerability represents a classic instance of SQL Injection, categorized under CWE-89 in the Common Weakness Enumeration framework. The technical mechanism involves manipulating the LO_sort parameter to alter the logic of the underlying SQL statement. Because the application constructs queries by concatenating user input directly into the command string rather than using prepared statements or stored procedures with bound parameters, the database engine interprets injected syntax as executable code. This allows for a wide range of malicious activities, including unauthorized data exfiltration, modification of existing records, deletion of critical information, and potentially gaining administrative privileges on the underlying database server if the application runs with elevated permissions.
The operational impact of this vulnerability is severe due to its remote exploitability. An attacker can initiate attacks over the network without requiring prior authentication or physical access to the system, classifying it under ATT&CK technique T1190: Exploit Public-Facing Application. The fact that a public exploit has been developed and disseminated significantly lowers the barrier for entry, enabling less sophisticated threat actors to compromise vulnerable instances. Successful exploitation could lead to significant data breaches involving sensitive student information, including personally identifiable information (PII), academic records, and potentially financial or health-related data depending on the specific modules integrated with openSIS-Classic. The lack of a response from the project maintainers further exacerbates the risk, as users are left without official patches or guidance for remediation during this critical window.
Mitigation strategies must focus on immediate defensive measures given the absence of an upstream patch. Administrators should implement strict input validation and output encoding to ensure that special characters in the LO_sort parameter are escaped or rejected before reaching the database layer. The most robust technical fix involves refactoring the DBQuery function to utilize prepared statements with parameterized queries, which inherently prevents SQL injection by separating code from data. In the interim, deploying a Web Application Firewall (WAF) with rules tuned to detect and block common SQL injection patterns targeting sort parameters can provide an additional layer of defense. Organizations should also conduct thorough audits of other endpoints within openSIS-Classic for similar vulnerabilities, as this flaw likely indicates broader issues in input handling practices across the application codebase.