CVE-2023-38885

OpenSIS Classic Community Edition 9.0 ships with no CSRF protection anywhere in the application. That means every state-changing action — creating accounts, altering records, changing settings — can be forged: if an attacker gets an authenticated user to load a malicious page while their OpenSIS session is live, the browser silently submits the attacker's request under that user's identity. Against an admin session, that reaches whatever the admin can do.

The gate is social engineering, which is why this leans on user interaction rather than being a direct remote takeover. But the app-wide absence of protection makes it broad rather than surgical — an attacker isn't limited to one forgeable action, they can target any of them. Student information systems hold sensitive records for minors and are administered by non-security staff who are exactly the population a convincing lure works on.

Because exploitation runs through the victim's browser, our leverage is detection and defensive framing at the edge — watching for state-changing requests that arrive with off-site or absent referrers, and reinforcing that admins keep OpenSIS sessions separate from general browsing. We prioritize instances where the admin console is broadly reachable, since a wider audience of logged-in users is what turns an app-wide CSRF gap into a practical attack.