CVE-2026-103116: OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection
A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LOsort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs valid low-privileged access because the vulnerability has a privileges-required rating of low. Exploitation can be initiated remotely and does not require user interaction.
Which deployments should be treated as affected?
OS4ED openSIS-Classic versions up to and including 9.3 are identified as affected. The available information does not state whether any particular configuration avoids exposure.
What is the immediate risk if patching is not available?
A public exploit is available, so affected instances should be considered at increased risk of attempted exploitation. Restrict access to the Student List Search Endpoint to trusted authenticated users and limit network exposure where operationally possible.
How can defenders identify possible exploitation?
Review requests to the Student List Search Endpoint for unexpected or malformed LO_sort parameter values. The supplied information does not provide specific payloads, log indicators, or database-level indicators of compromise.