OS4ED openSIS SQL Injection Vulnerability in Student Module

A SQL injection vulnerability has been identified in OS4ED openSIS versions 7.0 through 9.1. The issue arises in the Student module, specifically within the Student.php file, where the stu_id parameter is vulnerable to injection attacks.

Impact

Exploitation of this vulnerability allows for SQL injection, which could lead to unauthorized data access or manipulation in the application's database.

Reproduction

To reproduce this vulnerability, send a request to the Student.php file in the students module with a crafted stu_id parameter that includes SQL injection payloads. The application will improperly handle the input, allowing for the execution of arbitrary SQL commands.