openSIS-Classic CVE-2026-103115

Requires a valid authenticated session on the openSIS-Classic web application (PR:L - a low-privileged account such as staff or teacher suffices) and access to the Student Search component, which invokes functions/CustomFieldsFnc.php. The attack is triggered by manipulating the 'cust' argument and needs no user interaction (UI:N) and no special non-default configuration. Limiting factors: the authentication requirement excludes anonymous internet attackers, and the product's education-only, small-scale deployment narrows the exposed population; no vendor patch is confirmed, but the credentialed prerequisite is the main practical brake on exploitation.

This is a high-CVSS-but-moderate-real-risk issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3 (medium), with PR:L confirming authentication is required - an attacker needs a valid low-privileged account on the openSIS-Classic instance before reaching the vulnerable Student Search code path. The Exploit Maturity is E:P (proof-of-concept), consistent with a public exploit being released via the GitHub issue tracker (issue #475) but with NO evidence of active exploitation: this CVE is NOT in CISA KEV, and no EPSS score is provided. There is thus a clear gap between exploit availability (POC exists) and exploitation activity (none confirmed). The vendor rated impact as only VC/VI/VA:L (partial across the board), which understates a classic SQL injection - successful injection typically yields at least full read of the application database (C:H). The signals are internally consistent (POC-backed, authenticated, network-reachable) but point to a targeted, credentialed-insider or post-compromise scenario rather than mass exploitation, especially given the product's small footprint. Priority: low-to-medium - patch when able, but the authentication barrier and niche deployment limit urgency.

An attacker with a low-privileged authenticated account (e.g., a teacher or staff login) on an openSIS-Classic deployment navigates to the Student Search feature and supplies a crafted value in the 'cust' parameter that is concatenated into a SQL query in functions/CustomFieldsFnc.php. This injects attacker-controlled SQL, allowing extraction of student and staff records or other database contents. A public proof-of-concept exists (GitHub issue #475), lowering the skill required to reproduce the attack.