RosarioSIS CVE-2026-19785

Exploitation requires a valid authenticated session in RosarioSIS with access to the Student Medical Module - at minimum a low-privilege account (PR:L per the CVSS 4.0 vector). The attacker must supply a table request parameter naming a target database table and an integer id value corresponding to an existing row. No special server configuration, non-default deployment mode, or elevated privilege is required beyond a standard RosarioSIS installation with the Student Medical Module active. Exploitation is bounded by the authentication requirement - unauthenticated remote attackers cannot directly leverage this flaw. The DBEscapeIdentifier() wrapper limits exploitation to valid table name strings and prevents breakout via SQL metacharacters, but does not restrict which tables are reachable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3, reflecting network reachability and low complexity but requiring prior authentication with at least low privileges - a meaningful barrier against opportunistic mass exploitation. The real-world severity may exceed the score in insider-threat or credential-compromise scenarios, as a single authenticated user could systematically delete rows from any database table (users, grades, attendance records), causing data integrity and availability damage disproportionate to the medium score. EPSS data was not provided in the available intelligence, so statistical exploitation probability cannot be cited. There is no CISA KEV listing and no known public exploit code, indicating this has not been leveraged in widespread campaigns at time of analysis. The attack requires no user interaction and no special server configuration, but the authentication prerequisite and the niche deployment footprint of RosarioSIS together keep practical risk moderate. The promptness of the vendor patch (v12.8) reduces the exposure window for organizations that update regularly.

An authenticated school staff member or attacker holding a compromised low-privilege RosarioSIS account sends a crafted HTTP POST request to the Student Medical Module endpoint, setting the table parameter to a sensitive database table name (such as staff or program_user_config) and the id parameter to a known integer row identifier. The application executes a DELETE statement against the specified table without validation, silently removing the targeted record. No public exploit code is known at time of analysis, but the attack pattern is trivial - it requires only knowledge of valid table names and row IDs, both of which may be inferred from normal application usage.