This vulnerability in OS4ED openSIS-Classic up to version 9.3 allows remote attackers to exploit a SQL injection flaw via the LO_sort parameter in the DBQuery function located in functions/GetStuListFnc.php. The flaw exists in the Student List Search Endpoint component. Publicly available exploit code increases the risk of exploitation. The vendor has not provided a fix or official response at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate database queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 score of 5.3 indicates a medium impact with network attack vector, low privileges required, and no user interaction needed. However, the vulnerability does not have confirmed active exploitation in the wild.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or released remediation, users should monitor vendor communications for updates. Until a patch is issued, consider restricting access to the affected endpoint or applying web application firewall rules to detect and block SQL injection attempts targeting the LO_sort parameter.