# CVE-2026-103117: OS4ED openSIS-Classic SQL injection in Save Data Handler

Source: https://junglewise.ai/threats/cve-2026-103117-a-security-vulnerability-has-been-detected-in-os4ed-opensis  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-103117 · Severity: medium · CVSS 4.7 · Published 2026-09-30

openSIS-Classic is a student information system used by schools to manage enrollment and academic data. A SQL injection vulnerability in the student data save function allows an authenticated administrator to extract sensitive database information through time-based attacks, such as student records, staff data, or other institutional information. The vulnerability requires administrative access but poses a risk of unauthorized data exposure within the institution's database.

Technologies: [OS4ED openSIS Classic](https://junglewise.ai/threats/technologies/opensis-classic). Vendors: [OS4ED](https://junglewise.ai/threats/vendors/os4ed).

## Quick answers

**Is CVE-2026-103117 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103117 being exploited in the wild.

**How severe is CVE-2026-103117?** Medium severity, with a CVSS score of 4.7, published 30 September 2026.

**Which products and versions are affected?** OS4ED openSIS Classic up to 9.3.

**Is there a fix for CVE-2026-103117?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103117 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103117?** Check whether you run OS4ED openSIS Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in functions/DatabaseInc.php within the db_properties() function, which concatenates unsanitized POST array keys directly into a SHOW COLUMNS SQL statement. An attacker with administrative credentials can craft a malicious values[] array key containing SQL WHERE clauses with subqueries to perform blind SQL injection. The db_properties() function fails to parameterize or whitelist table names, and error pages echo the full SQL statement, enabling both time-based and error-based injection to exfiltrate arbitrary database content.

## Affected products

- OS4ED openSIS-Classic up to 9.3

## Timeline

- 2026-09-01: disclosed: Vulnerability reported via GitHub issue #477
- 2026-09-30: disclosed: CVE-2026-103117 published on NVD

## References

- [https://github.com/OS4ED/openSIS-Classic/](https://github.com/OS4ED/openSIS-Classic/)
- [https://github.com/OS4ED/openSIS-Classic/issues/477](https://github.com/OS4ED/openSIS-Classic/issues/477)

## Related threats

- [openSIS Classic insecure direct object reference in staff password reset](https://junglewise.ai/threats/cve-2026-91107-opensis-classic-9-3-allows-an-authenticated-user-with-the-built)
- [OS4ED openSIS-Classic SQL injection in student list search](https://junglewise.ai/threats/cve-2026-103116-a-weakness-has-been-identified-in-os4ed-opensis-classic-up-to-9)
- [OS4ED openSIS-Classic SQL injection in Student Search](https://junglewise.ai/threats/cve-2026-103115-a-security-flaw-has-been-discovered-in-os4ed-opensis-classic-up)
- [OS4ED openSIS-Classic SQL injection in Assignment Management](https://junglewise.ai/threats/cve-2026-103114-a-vulnerability-was-identified-in-os4ed-opensis-classic-up-to-9)
- [OS4ED openSIS-Classic SQL injection in student fields](https://junglewise.ai/threats/cve-2026-103113-a-vulnerability-was-determined-in-os4ed-opensis-classic-up-to-9)