CVE-2025-22929

An attacker sends a crafted HTTP request containing a malicious payload in the filter_id parameter to the /students/StudentFilters.php endpoint. Input data is not properly validated or sanitized before use in an SQL query, allowing injection of arbitrary SQL instructions. Since the attack does not require authentication or user interaction, it can be conducted remotely by anyone with network access to the application.

An attacker can gain unauthorized access to the database, read, modify, or delete student data and other sensitive information stored in the system. Depending on the database server configuration, it is also possible to take control of the server's operating system.

Apply patches available from the vendor according to references. It is recommended to update to a version higher than 9.1 and restrict access to the openSIS application only to trusted networks or users (e.g., through a firewall or VPN) until the patch is implemented.

Os4Ed openSIS versions 7.0 to 9.1