The vulnerability in OS4ED openSIS-Classic up to 9.3 is a SQL injection flaw located in the save action function of the file modules/students/Student.php, specifically in the General Information Tab component. Attackers with high privileges can remotely manipulate the 'students' argument to execute SQL injection attacks. The issue was reported early to the project but remains unaddressed. The CVSS 3.1 base score is 4.7, reflecting low severity with network attack vector, low attack complexity, required high privileges, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized SQL commands execution, potentially compromising data confidentiality, integrity, and availability within the affected component. However, exploitation requires high privileges, limiting the attack surface. No known exploits are currently observed in the wild.

No official patch or remediation has been released by the vendor as of the current information. Users should monitor the vendor's advisories for updates. Until a fix is available, restrict access to the affected functionality to trusted users with high privileges and consider additional input validation or database query hardening as temporary mitigations.