A flaw exists in the db_properties function of functions/DatabaseInc.php in OS4ED openSIS‑Classic versions up to 9.3. Manipulation of argument values is not properly neutralized, allowing an attacker to inject arbitrary SQL statements. The vulnerability is a classic example of improper handling of user input that leads to SQL injection, corresponding to CWE‑74 and CWE‑89. If exploited, an attacker could read, modify, or delete data in the application database, thereby compromising confidentiality, integrity, and potentially availability of the system.

The affected product is OS4ED's openSIS‑Classic application, up to and including release 9.3. No patch or fix has been released by the vendor, and the project has not yet responded to reported vulnerability findings.

The CVSS base score of 5.1 indicates a moderate overall risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely, and the exploit has been publicly disclosed, so the likelihood of exploitation exists, especially on systems exposed to the internet. Administrators should treat this as a medium‑to‑high threat pending vendor remediation.