EUVD-2026-89949
GHSA-62rw-f9gr-88jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with high-privilege account
-
DeliveryReach Save Data Handler save operation
-
ExploitInject SQL via manipulated argument values
-
Executiondb_properties builds unsafe query
-
ImpactExfiltrate or alter database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session with high privileges (CVSS PR:H) on an openSIS-Classic instance at version 9.3 or earlier; the attacker must be able to reach the Save Data Handler code path and supply argument values that pass into the db_properties function in functions/DatabaseInc.php. No user interaction is needed (UI:N) and the vector is network-remote (AV:N), but the PR:H requirement means anonymous or low-privilege users cannot exploit it directly. No official patch is confirmed since the vendor has not responded, so all deployments up to 9.3 should be treated as exposed to privileged users. |
| Impact | This is a low-real-priority issue despite being a SQL injection (CWE-89), which is normally serious. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:L/VI:L/VA:L) yields only 2.0, driven down by PR:H (high privileges required) and uniformly Low impact ratings. I disagree with the uniformly-Low impacts: a reachable SQL injection typically permits full database read (student PII, credentials), so a Confidentiality:High rating is more defensible - my recomputed CVSS 3.1 is ~7.6 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L). The mitigating reality is PR:H: an attacker must already hold a high-privilege authenticated account (per CVSS PR:H), sharply limiting the practical population of attackers. A public POC exists (VulDB, GitHub issue #477), which raises opportunistic risk, but there is no EPSS score and no CISA KEV listing, so there is no evidence of active exploitation - POC availability and active exploitation are distinct signals. Net: a genuine but narrow-audience flaw in a niche product; prioritize patching but it is not an emergency. Note conflict: vendor scores impact as Low across the board while the CWE-89 class implies higher confidentiality impact - verify actual injectable scope against the DatabaseInc.php code. |
| Exploit ScenarioDerived | A high-privilege authenticated user of an openSIS-Classic deployment submits crafted argument values that flow into the db_properties function in functions/DatabaseInc.php (the Save Data Handler), breaking out of the intended SQL query to read or manipulate database contents such as student records and account data. Publicly available exploit code exists (VulDB, referenced GitHub issue #477), lowering the skill barrier. Because CVSS specifies PR:H, exploitation requires an existing privileged account rather than anonymous network access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
SQL injection in OS4ED openSIS-Classic up to and including 9.3 lets an authenticated, highly privileged user manipulate the argument values reaching the db_properties function in functions/DatabaseInc.php, allowing crafted input to alter or extract database contents through the Save Data Handler code path. The flaw is network-reachable and needs no user interaction, but the CVSS vector requires PR:H, so anonymous or low-privilege accounts cannot reach it directly; publicly available exploit code exists via the project's public issue report. The vendor was notified through that issue and has not responded, so no vendor-released patch is identified at time of analysis, and the overall real-world risk is assessed as low despite the SQL injection class.
RemediationAI
No vendor-released patch is identified at time of analysis: OS4ED was informed via the public issue report (https://github.com/OS4ED/openSIS-Classic/issues/477) and has not responded, and the referenced VulDB entries (https://vuldb.com/vuln/411873, https://vuldb.com/cve/CVE-2026-103117) provide no fixed version. Until upstream ships a fix, apply targeted compensating controls. First, reduce the population that can reach the vulnerable path: audit openSIS-Classic accounts and remove or demote every user who does not strictly need Save Data Handler privileges, since exploitation requires a high-privilege session (PR:H); this shrinks the attack surface but reduces administrative usability. Second, add input validation or parameterization at db_properties in functions/DatabaseInc.php for local deployments that can maintain a fork, converting concatenated query construction to bound parameters; this is the most durable mitigation but creates a maintenance divergence from upstream that must be tracked. Third, place a WAF or reverse proxy rule in front of the application to block SQL metacharacter payloads (quote, comment sequence, UNION, boolean tautology patterns) on requests that reach functions/DatabaseInc.php or the Save Data Handler endpoint; accept the trade-off of false positives on legitimate free-text fields and the need to tune rules. Fourth, enforce a least-privilege database account for the application so injected statements cannot perform DDL, file access, or cross-schema reads, and enable database query logging plus application audit logging to detect abuse of the vulnerable path. If the Save Data Handler cannot be segmented or monitored, restricting network access to the application to trusted administrative networks is the last-resort control, at the cost of remote availability for staff.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is legacy PHP: the db_properties helper inside functions/DatabaseInc.php assembles database queries from caller-supplied argument values, and the Save Data Handler component forwards user-controllable values into it. This is CWE-89, improper neutralization of special elements used in an SQL command, meaning the root cause is string-concatenated query construction rather than parameterized statements (prepared statements or strict allow-listing of identifiers and value types). Because the parameter is a value channel rather than a query structure channel, the practical exploitability depends on the code path that reaches db_properties and the database privileges of the application account. The CPE cpe:2.3:a:os4ed:opensis-classic:*:*:*:*:*:*:*:* uses a wildcard version, confirming that the vendor has not scoped the fix to a specific release line. The affected function is fully described in package and tag metadata by PHP, SQLi, OS4ED and openSIS-Classic tags.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network SQLi requiring an existing high-privilege account (PR:H); injection enables broad database read (C:H) with limited write/availability effect (I:L/A:L).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB