openSIS-Classic CVE-2026-103114

Requires a valid low-privileged authenticated session in openSIS-Classic (PR:L) and network reachability to the application; the attacker sends a request to the Assignment Management endpoint (modules/grades/Assignments.php) and manipulates the Tables argument passed to DBQuery_assignment. No user interaction and no special non-default configuration are needed beyond having an account. The primary limiting factor is the authentication requirement - anonymous internet-wide exploitation is not possible - plus the product's small deployment footprint.

Signals are mixed and point to a low-to-moderate real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms remote exploitation with low attack complexity and no user interaction, but requires low-level authentication (PR:L) - i.e., a valid, if unprivileged, application account. The vendor-supplied 4.0 base score of 5.3 rests on conservative VC:L/VI:L/VA:L impact ratings, which likely understate a classic SQL injection: injection into the query's Tables argument typically permits broad database read (and often modification), so confidentiality impact is plausibly higher than the 'Low' assigned. The vector carries E:P (Proof-of-Concept), consistent with the confirmed public exploit at the GitHub issue. There is no EPSS score and no CISA KEV listing in the provided data, so there is no evidence of active exploitation - the exploit code exists but exploitation status remains 'publicly available exploit code exists,' not confirmed in-the-wild use. Net: a genuine, easily reproduced SQLi with a public PoC, but gated behind authentication and affecting a niche product, which caps its urgency below internet-scale unauthenticated flaws. The vendor has been notified but has not responded, so no patch is confirmed available.

An attacker with any low-privileged openSIS-Classic account (e.g., a student or staff login) sends a crafted request to the Assignment Management endpoint (modules/grades/Assignments.php), injecting SQL through the Tables parameter consumed by DBQuery_assignment. Because a public exploit is available via the OS4ED GitHub issue tracker, an attacker can reproduce the injection with minimal effort to read or manipulate arbitrary database records such as student records, grades, and credentials.