EUVD-2026-58568
GHSA-9q5c-5jw2-5hfp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web app requires low-privilege auth (PR:L); only low integrity impact (I:L) via unauthorized record modification; no confidentiality or availability impact confirmed.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.
AnalysisAI
Authorization bypass via Insecure Direct Object Reference (IDOR) in RosarioSIS up to version 12.8 allows authenticated low-privilege users to manipulate numeric record IDs in HTTP requests to save or delete records belonging to other schools within the same multi-tenant installation. The vulnerability is program-wide, affecting at least Accounting, Attendance, and Discipline modules - not limited to Discipline/Referrals.php as the CVE description implies. A publicly available exploit exists (GitHub issue #301); the flaw is not in CISA KEV and CVSS 4.0 scores it at 2.1 with an active proof-of-concept modifier.
Technical ContextAI
RosarioSIS (CPE: cpe:2.3:a:francoisjacquet:rosariosis:*:*:*:*:*:*:*:*) is a PHP-based open-source Student Information System for K-12 schools. The root cause is CWE-639: Authorization Bypass Through User-Controlled Key (IDOR). Database update and delete queries across multiple modules accepted a user-supplied numeric ID (e.g., WHERE ID='<int>') without verifying that the referenced record's SCHOOL_ID or SYEAR matched the authenticated user's own school context. The fix, committed as 04dd1a368ddf80ad7082baefa3c656e4e1825c76, adds AND SCHOOL_ID='UserSchool()' AND SYEAR='UserSyear()' constraints to affected queries across Accounting/Categories.php, Accounting/Expenses.php, Accounting/Incomes.php, Accounting/Salaries.php, Accounting/StaffPayments.php, Attendance/AttendanceCodes.php, Discipline/DisciplineForm.php, and Discipline/Referrals.php. This is a multi-tenant isolation failure, not merely a single-function flaw.
RemediationAI
Upgrade to RosarioSIS version 12.9, which includes commit 04dd1a368ddf80ad7082baefa3c656e4e1825c76 applying SCHOOL_ID and SYEAR constraints to all affected database queries. The release is available at https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9; upgrade via git pull and checkout of the v12.9 tag, or by overwriting files, as documented in the release notes. Note that v12.9 includes breaking changes requiring updated companion add-ons: Reports module 12.1+, NFC/QR Actions module 2.6+, and Parent Agreement plugin 10.5+. If immediate upgrade is not possible, a compensating control is to restrict RosarioSIS to single-school deployments (eliminating cross-school IDOR risk) or to enforce network-level access controls so only trusted, role-appropriate users can reach the application - both measures reduce but do not eliminate risk from insider threats.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today