openSIS-Classic CVE-2026-103113

Exploitation requires an authenticated high-privilege openSIS-Classic account (CVSS PR:H) able to reach the save action of the General Information Tab, which invokes modules/students/Student.php; the injection is delivered through the user-controlled 'students' argument. The attack is remote over the network with no user interaction, but the mandatory high-privilege authentication is the key limiting factor - this is not exploitable pre-authentication or by low-privilege users. No non-default configuration is otherwise required beyond a standard deployment of openSIS-Classic 9.0 through 9.3; no fixed version is available since the vendor has not responded.

This is a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:L/VI:L/VA:L, E:P) describes a network-reachable but privilege-gated SQL injection: PR:H means the attacker already needs a high-privilege authenticated account in the application before the save action of the General Information Tab is reachable, which sharply limits the realistic attacker pool to insiders or accounts already compromised. Only partial confidentiality, integrity, and availability impact (VC/VI/VA:L) is claimed rather than full database compromise, keeping the score at 5.1. A public exploit exists (VulDB, GitHub issue #475) and E:P (Proof-of-Concept) is encoded in the vector, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of widespread or automated exploitation - the POC raises reproducibility but not necessarily mass-exploitation likelihood. The PR:H gate is the dominant limiting signal and should temper any inflation from the 'public exploit' flag; treat this as a targeted/insider-abuse or chained-post-authentication risk rather than an internet-wide emergency. The vendor has been notified but has not responded, so no fix is currently confirmed available.

An attacker holding a high-privilege authenticated openSIS-Classic account (e.g. a compromised staff/admin login) submits the student General Information save form and tampers with the 'students' argument, injecting SQL that the Student.php save action passes unsanitized into a database query. A publicly disclosed proof-of-concept exists (GitHub issue #475), lowering the effort to reproduce and enabling reading or modifying database records beyond the attacker's intended scope.