Francoisjacquet
Monthly
Cross-site request forgery in RosarioSIS up to version 12.8 allows a remote unauthenticated attacker to trigger unintended state-changing actions in Modules.php by luring an authenticated user to a malicious page. The vulnerability stems from the absence of CSRF token validation on the modfunc parameter, compounded by insufficient sanitization of modfunc= in rendered HTML/Markdown output via MarkDownHTML.fnc.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-confirmed patch is available in v12.9.
Arbitrary database table row deletion in RosarioSIS up to version 12.7.4 allows authenticated users to issue DELETE statements against any table in the database by manipulating the unsanitized `table` parameter in `modules/Students/includes/Medical.inc.php`. While `DBEscapeIdentifier()` prevents classic SQL injection syntax escapes, it does not restrict which table is targeted - enabling destruction of records far beyond the medical module's intended scope, including user accounts, grades, or other critical school data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 12.8.
Authorization bypass via Insecure Direct Object Reference (IDOR) in RosarioSIS up to version 12.8 allows authenticated low-privilege users to manipulate numeric record IDs in HTTP requests to save or delete records belonging to other schools within the same multi-tenant installation. The vulnerability is program-wide, affecting at least Accounting, Attendance, and Discipline modules - not limited to Discipline/Referrals.php as the CVE description implies. A publicly available exploit exists (GitHub issue #301); the flaw is not in CISA KEV and CVSS 4.0 scores it at 2.1 with an active proof-of-concept modifier.
Cross-site request forgery in RosarioSIS up to version 12.8 allows a remote unauthenticated attacker to trigger unintended state-changing actions in Modules.php by luring an authenticated user to a malicious page. The vulnerability stems from the absence of CSRF token validation on the modfunc parameter, compounded by insufficient sanitization of modfunc= in rendered HTML/Markdown output via MarkDownHTML.fnc.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-confirmed patch is available in v12.9.
Arbitrary database table row deletion in RosarioSIS up to version 12.7.4 allows authenticated users to issue DELETE statements against any table in the database by manipulating the unsanitized `table` parameter in `modules/Students/includes/Medical.inc.php`. While `DBEscapeIdentifier()` prevents classic SQL injection syntax escapes, it does not restrict which table is targeted - enabling destruction of records far beyond the medical module's intended scope, including user accounts, grades, or other critical school data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 12.8.
Authorization bypass via Insecure Direct Object Reference (IDOR) in RosarioSIS up to version 12.8 allows authenticated low-privilege users to manipulate numeric record IDs in HTTP requests to save or delete records belonging to other schools within the same multi-tenant installation. The vulnerability is program-wide, affecting at least Accounting, Attendance, and Discipline modules - not limited to Discipline/Referrals.php as the CVE description implies. A publicly available exploit exists (GitHub issue #301); the flaw is not in CISA KEV and CVSS 4.0 scores it at 2.1 with an active proof-of-concept modifier.