OpenSIS CVE-2025-65594

Exploitation requires a valid authenticated OpenSIS session at low privilege (PR:L) - an unauthenticated outsider cannot trigger it, which is the primary limiting factor. The attacker targets the Student.php endpoint and manipulates object references to perform writes on other users' data; no user interaction, elevated role, or non-default configuration is stated as necessary beyond having any legitimate account on an OpenSIS 9.2-or-earlier instance. Limiting factors: the account gate means realistic threat actors are insiders (students or staff) or attackers who have already obtained low-tier credentials, and impact is confined to write and tampering operations per the description.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) reflects a network-reachable, low-complexity flaw requiring only low privileges and no user interaction. However, the description explicitly scopes impact to unauthorized WRITE operations on other users' data, which supports a High integrity impact but does NOT clearly support the High confidentiality impact asserted in the supplied vector - this discrepancy should be verified with the vendor, and my independent assessment lowers confidentiality to None (base ~6.5). EPSS is low (0.26%) and the CVE is not in CISA KEV, so despite public POC availability this is not evidence of active or automated mass exploitation. Net: a genuine authenticated-tampering risk warranting prompt patching in any internet-exposed OpenSIS instance, but a tier below unauthenticated RCE-class emergencies.

A student or other low-privilege user logs into the OpenSIS web portal, then sends a crafted request to Student.php referencing another user's record identifier to write or alter data they do not own - for example modifying another student's information. Because publicly available exploit code exists and attack complexity is low with no user interaction required, a motivated authenticated insider could reproduce this reliably.