CVE-2026-103114

OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection

View on CVE.org
Published Sep 30, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

A flaw in the DBQuery_assignment function within Assignments.php allows an attacker that can craft the Tables argument to inject arbitrary SQL commands. The injection is remote, meaning it can be triggered through the web interface. If the attack is successful, an attacker could potentially read, modify, or delete database records, compromising confidentiality and integrity of student records. This impact is inferred from the description and not explicitly verified.

Affected Systems

OS4ED openSIS-Classic through version 9.3. The vulnerable component is the Assignment Management Endpoint, specifically modules/grades/Assignments.php. Any instance running a 9.3 or earlier build is at risk.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, placing it in the moderate range. No EPSS score is reported, and it is not currently flagged in the CISA KEV catalogue. The CVE description states that exploitation is possible remotely and that a publicly available exploit exists. The likelihood of real‑world exploitation is inferred from these facts, but has not been confirmed.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade OS4ED openSIS-Classic to a version newer than 9.3 where the vulnerability is addressed.
  • Restrict access to the Assignment Management Endpoint or protect it with a web‑application firewall that filters injected SQL patterns.
  • Continuously monitor database and web server logs for anomalous queries or repeated manipulation of the Tables parameter to detect attempted exploitation.

Generated by OpenCVE AI on September 30, 2026 at 13:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Title OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection
First Time appeared Os4ed
Os4ed opensis-classic
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:os4ed:opensis-classic:*:*:*:*:*:*:*:*
Vendors & Products Os4ed
Os4ed opensis-classic
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 30, 2026, 1:47 PM
Reserved
Sep 30, 2026, 5:51 AM

View source JSON

Updated
Sep 30, 2026, 1:47 PM

JSON

Status
Deferred
Published
Sep 30, 2026, 12:17 PM
Modified
Sep 30, 2026, 2:17 PM

View source JSON

No data.

Updated
Sep 30, 2026, 1:30 PM

JSON