A critical access control vulnerability in OpenSIS 9.2 and below allows authenticated users to perform unauthorized database write operations, posing a significant risk to data integrity.

The software suffers from an incorrect access control flaw within the Student.php file. This vulnerability enables any authenticated user with low privileges to bypass intended security constraints and execute unauthorized write operations against the database affecting other users.

The ability for low-privilege users to modify student records or other sensitive database entries represents a major threat to data integrity and institutional compliance. Given the CVSS score of 8.1, this vulnerability is classified as High severity, as it facilitates unauthorized data manipulation that could lead to widespread information corruption or privacy violations.

Immediate Action: Since a specific patch version is currently unknown, administrators should contact the vendor immediately to obtain the latest security hotfix or version release that addresses the flaw in Student.php.

Proactive Monitoring: Review application access logs for unusual patterns of database activity, specifically looking for write operations originating from accounts that lack administrative or data-editing permissions.

Compensating Controls: Implement strict database-level permissions where possible and ensure that web application firewalls are configured to monitor and block abnormal requests directed at the Student.php endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the technical write-up provided in the referenced GitLab repository.

Given the availability of a public proof-of-concept and the ease of exploitation for authenticated users, this vulnerability requires immediate attention. Organizations utilizing OpenSIS versions 9.2 or earlier should prioritize restricting user access levels and engaging with the vendor to secure a resolution, as the risk of unauthorized data modification is substantial.