Threats affecting pkg:github/os4ed/openSIS-Classic

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A SQL injection vulnerability exists in OS4ED openSIS-Classic up to version 9.3 in the save action function of modules/students/Student.php within the General Information Tab component. This vulnerability allows remote attackers with high privileges to manipulate the 'students' argument to execute SQL injection attacks. The vulnerability has a medium severity score of 4.7 and has been publicly disclosed. The project has been informed but has not yet responded or issued a patch.

A SQL injection vulnerability exists in OS4ED openSIS-Classic up to version 9.3 in the DBQuery_assignment function within the Assignment Management Endpoint. This vulnerability allows remote attackers with low privileges to manipulate the 'Tables' argument to execute SQL injection attacks. The vulnerability has a CVSS 3.1 score of 6.3, indicating a medium severity impact on confidentiality, integrity, and availability. The project has been notified but has not yet responded or issued a fix. Exploit code is publicly available, but no active exploitation in the wild has been reported.

CVE-2026-103115 is a medium severity SQL injection vulnerability in OS4ED openSIS-Classic versions 9.0 through 9.3. The flaw exists in the Student Search component, specifically in the functions/CustomFieldsFnc.php file, where manipulation of the 'cust' argument allows remote attackers to perform SQL injection. The vulnerability has a public exploit available, but the vendor has not yet responded or issued a patch.

openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.

SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.php