Description
A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-30
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Apply Patch
AI Analysis

Impact

A flaw in the DBQuery_assignment function within Assignments.php allows an attacker that can craft the Tables argument to inject arbitrary SQL commands. The injection is remote, meaning it can be triggered through the web interface. If the attack is successful, an attacker could potentially read, modify, or delete database records, compromising confidentiality and integrity of student records. This impact is inferred from the description and not explicitly verified.

Affected Systems

OS4ED openSIS-Classic through version 9.3. The vulnerable component is the Assignment Management Endpoint, specifically modules/grades/Assignments.php. Any instance running a 9.3 or earlier build is at risk.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, placing it in the moderate range. No EPSS score is reported, and it is not currently flagged in the CISA KEV catalogue. The CVE description states that exploitation is possible remotely and that a publicly available exploit exists. The likelihood of real‑world exploitation is inferred from these facts, but has not been confirmed.

Generated by OpenCVE AI on September 30, 2026 at 13:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade OS4ED openSIS-Classic to a version newer than 9.3 where the vulnerability is addressed.
  • Restrict access to the Assignment Management Endpoint or protect it with a web‑application firewall that filters injected SQL patterns.
  • Continuously monitor database and web server logs for anomalous queries or repeated manipulation of the Tables parameter to detect attempted exploitation.

Generated by OpenCVE AI on September 30, 2026 at 13:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Title OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection
First Time appeared Os4ed
Os4ed opensis-classic
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:os4ed:opensis-classic:*:*:*:*:*:*:*:*
Vendors & Products Os4ed
Os4ed opensis-classic
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Os4ed Opensis-classic
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-30T13:47:09.418Z

Reserved: 2026-09-30T05:51:34.239Z

Link: CVE-2026-103114

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-30T12:17:12.457

Modified: 2026-09-30T14:17:27.010

Link: CVE-2026-103114

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T13:30:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')