openSIS-Classic CVE-2026-103116

Requires an authenticated session (PR:L) on an OS4ED openSIS-Classic instance at version 9.3 or earlier and the ability to reach the Student List Search endpoint that invokes functions/GetStuListFnc.php. The specific injection point is the LO_sort argument, which is passed unsanitized into the DBQuery function. Exploitation is remote and needs no user interaction, and a public PoC lowers the skill barrier; the primary limiting factors are the valid low-privileged account and the product's small deployment base. No non-default configuration is required.

This is an authenticated (CVSS PR:L) SQL injection in a niche open-source PHP student information system, so real-world priority is modest despite SQLi's usually high ceiling. The vendor/VulDB CVSS 4.0 base score is only 2.1 with VC:L/VI:L/VA:L, which materially UNDERSTATES a classic SQL injection - a working SQLi in the LO_sort argument typically permits reading arbitrary database contents (student PII, credentials), so confidentiality impact is better modeled as High, not Low; I therefore disagree with the vendor's low impact rating (flagged in confidence_notes, not as a data-quality flag). A public exploit exists (GitHub issue #476, E:P/'Proof-of-Concept' in the 4.0 vector), which raises practical exploitability, but there is no EPSS score and no CISA KEV listing provided, so this is publicly available exploit code - NOT confirmed active exploitation. The attack is network-reachable and low-complexity but requires a valid low-privileged account (PR:L), which is the main limiting factor. No SSVC decision data was supplied. Net: a genuine, easily-exploitable flaw whose real-world risk is capped by low deployment footprint and the authentication requirement, not by the (implausibly low) vendor score.

An authenticated low-privileged user of an openSIS-Classic deployment sends a crafted request to the Student List Search endpoint with a malicious LO_sort value that is concatenated into the SQL query in GetStuListFnc.php's DBQuery function. Because a public proof-of-concept is available (GitHub issue #476), the attacker can reliably extract student records, staff data, and potentially password hashes from the backend database via UNION-based or error-based injection. Exploitation is remote and low-complexity but requires a valid application login.