# CVE-2026-103116: OS4ED openSIS-Classic SQL injection in student list search

Source: https://junglewise.ai/threats/cve-2026-103116-a-weakness-has-been-identified-in-os4ed-opensis-classic-up-to-9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-103116 · Severity: medium · CVSS 6.3 · Published 2026-09-30

openSIS-Classic is a web-based student information system used by schools to manage grades, attendance, and student data. An SQL injection vulnerability in the student list search function allows a logged-in teacher to extract arbitrary data from the database, including student records and system information, through a manipulated sort parameter.

Technologies: [OS4ED openSIS Classic](https://junglewise.ai/threats/technologies/opensis-classic). Vendors: [OS4ED](https://junglewise.ai/threats/vendors/os4ed).

## Quick answers

**Is CVE-2026-103116 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103116 being exploited in the wild.

**How severe is CVE-2026-103116?** Medium severity, with a CVSS score of 6.3, published 30 September 2026.

**Which products and versions are affected?** OS4ED openSIS Classic up to 9.3.

**Is there a fix for CVE-2026-103116?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103116 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-103116?** Check whether you run OS4ED openSIS Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the LO_sort parameter of the student list search endpoint (modules/grades/EditReportCardGrades.php), which is concatenated directly into an ORDER BY clause without validation or sanitization. An authenticated teacher can inject arbitrary SQL expressions that are evaluated by the database, enabling both time-based blind injection and error-based data extraction. The attack requires valid teacher credentials and normal course scheduling data.

## Affected products

- OS4ED openSIS-Classic up to 9.3

## Timeline

- 2026-09-30: disclosed: Published on NVD
- 2026-09-01: other: Issue reported to project on GitHub (#476)

## References

- [https://github.com/OS4ED/openSIS-Classic/](https://github.com/OS4ED/openSIS-Classic/)
- [https://github.com/OS4ED/openSIS-Classic/issues/476](https://github.com/OS4ED/openSIS-Classic/issues/476)

## Related threats

- [openSIS Classic insecure direct object reference in staff password reset](https://junglewise.ai/threats/cve-2026-91107-opensis-classic-9-3-allows-an-authenticated-user-with-the-built)
- [OS4ED openSIS-Classic SQL injection in Save Data Handler](https://junglewise.ai/threats/cve-2026-103117-a-security-vulnerability-has-been-detected-in-os4ed-opensis)
- [OS4ED openSIS-Classic SQL injection in Student Search](https://junglewise.ai/threats/cve-2026-103115-a-security-flaw-has-been-discovered-in-os4ed-opensis-classic-up)
- [OS4ED openSIS-Classic SQL injection in Assignment Management](https://junglewise.ai/threats/cve-2026-103114-a-vulnerability-was-identified-in-os4ed-opensis-classic-up-to-9)
- [OS4ED openSIS-Classic SQL injection in student fields](https://junglewise.ai/threats/cve-2026-103113-a-vulnerability-was-determined-in-os4ed-opensis-classic-up-to-9)