CVE-2026-103114: OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection
A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQueryassignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs at least low-level privileges, as reflected by the PR:L vector. The vulnerable Assignment Management Endpoint is remotely reachable, so exploitation does not require local access or user interaction.
Are installations running openSIS-Classic 9.3 affected?
Yes. The affected range is stated as openSIS-Classic up to and including version 9.3.
What is the practical impact of successful exploitation?
The vulnerability is SQL injection in the Tables argument passed to DBQuery_assignment. The published vector indicates potential low impact to confidentiality, integrity, and availability.
How urgent is remediation?
A public exploit is available and the issue has a medium severity score of 6.3. The project was reportedly notified but had not responded at the time of publication.