RosarioSIS EUVD-2026-109809

Exploitation targets the Food_Service MenuReports.php page reached via Modules.php; the attacker supplies a crafted menu_id (or modname) parameter that, because it is concatenated unescaped into a double-quoted <form action="..."> attribute, breaks out and injects an onmouseover handler. The attacker needs no account (PR:N), but exploitation is LIMITED by a hard prerequisite: an authenticated administrator must be logged in AND must open the attacker's link and interact with the injected element (UI:P / passive user interaction) for the payload to fire in their session. Affected versions are RosarioSIS before 12.9.2; upgrading to 12.9.2 (which adds URLEscape() around the reflected value) removes the flaw.

This is a reflected XSS (CWE-79) in RosarioSIS MenuReports.php where the menu_id and modname request parameters are echoed unescaped into a <form action> attribute (confirmed by the vendor commit 08c871d, which wraps the value in URLEscape()). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N, score 5.3) is internally consistent with a reflected XSS: network-reachable, low complexity, no attacker authentication, but requiring passive user interaction (UI:P) - the attacker cannot act alone, they must lure an authenticated administrator into opening a crafted link. Impact is rated Low across confidentiality/integrity because a single reflected injection yields script execution in one victim's session rather than wholesale system compromise, though the description notes the practical payoff is theft of session and CSRF tokens, enabling the attacker to act as that administrator. No EPSS score and no KEV listing were provided; the vuln.today decision label is 'this_month' (not act_now/emergency), and the reporter is VulnCheck. No PoC or exploit reference is present in the input beyond a pointer to the vulnerable source line. Net: a genuine, patch-now-this-cycle issue but not an emergency - real risk hinges on social-engineering a logged-in admin, so it is a targeted rather than mass-exploitable flaw. EPSS and KEV data are MISSING and could not be weighed.

An attacker crafts a Modules.php link targeting the Food_Service MenuReports page with a double-quoted menu_id (or modname) value that breaks out of the <form action> attribute and injects an onmouseover event handler. The attacker sends this link to a logged-in RosarioSIS administrator (e.g. via email or chat); when the admin opens it and the mouse passes over the element, the injected JavaScript runs in the admin's authenticated context and exfiltrates session and CSRF tokens, letting the attacker perform actions as that administrator. No public exploit code is identified in the provided data.