The vulnerability is an input validation flaw allowing a malicious user to inject SQL via the LO_sort parameter in the DBQuery function of functions/GetStuListFnc.php. When exploited, the attacker can manipulate the database query to read, modify or delete data, resulting in unauthorized data disclosure and potential data integrity loss. The flaw is present in OS4ED openSIS‑Classic versions up to 9.3.

Affected systems are installations of OS4ED openSIS‑Classic through version 9.3. The exploit targets the Student List Search Endpoint, specifically the GetStuListFnc.php component that handles the DBQuery operation. No official vendor patch has been provided yet, and the project has not responded to the issue.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, but the public availability of an exploit means attackers can target the endpoint over the internet. The attack vector is remote, and the flaw allows arbitrary SQL code execution, giving attackers the ability to exfiltrate sensitive data or compromise the database.