RosarioSIS CVE-2026-121731

Requires an authenticated session as a non-student role (teacher, staff, or parent account) in RosarioSIS before 12.9. The specific trigger is the unquoted period_id request parameter handled in modules/Attendance/includes/StudentSummary.php, which is passed directly into an IN() clause; the fix casts it with (int), confirming no quoting or parameterization was applied. Because payloads do not need single quotes, standard quote-based input filtering does not limit exploitation. Limiting factors: an attacker must first hold valid credentials for a non-student role (not unauthenticated), the instance must be network-reachable, and only versions prior to 12.9 are affected - upgrading to 12.9 removes the flaw.

This is a credible, prioritize-this-week issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the provided base score of 8.7 are consistent with the evidence: network-reachable, low-complexity SQL injection requiring only low-privileged authentication, with high impact to confidentiality, integrity and availability of the vulnerable system (VC:H/VI:H/VA:H). The source-code evidence strongly corroborates the mechanism - the fix in commit 1b809f9 simply casts period_id to (int), confirming the parameter reached the query unsanitized. The vuln.today decision label is 'this_week', not act_now or emergency. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were supplied, so there is no signal of active or widespread exploitation; the realistic risk is that any authenticated non-student account (staff, teacher, or even a parent) can be turned into a full database compromise. The main caveat is the PR:L requirement - this is not an unauthenticated internet-wide threat, so exposure depends on how many non-student accounts exist and whether the instance is internet-facing. No key signals conflict; the gap is simply the absence of exploitation-probability (EPSS) and exploited-in-the-wild (KEV) data.

An authenticated non-student user - such as a teacher, staff member, or parent - opens the Attendance Student Summary report and tampers with the period_id request parameter, injecting SQL without single quotes into the IN() clause. Using time-based blind techniques they extract administrator password hashes and student records, or use stacked statements to modify data. No public exploit code was supplied, but the vulncheck advisory, the GitLab issue #375, and the one-line (int) cast fix make the attack path well understood and easy to reproduce.