Rosariosis
Monthly
Authenticated path traversal in RosarioSIS before version 12.9 lets any logged-in user (student, teacher, or staff) delete allow-listed files anywhere in the installation by inserting parent-directory ('../') sequences into the filename request parameter of the file-deletion functionality in the Users and Students modules. The impact is primarily integrity (I:H) with a limited availability effect (A:L), no confidentiality exposure, and no user interaction required, but exploitation is gated by a valid account (PR:L), so risk is moderate rather than critical. No public exploit code was identified at the time of analysis, and the issue is remediated by upgrading to 12.9.
Reflected cross-site scripting in RosarioSIS before 12.9.2 allows an unauthenticated attacker to break out of the double-quoted form action attribute on the Food_Service MenuReports page by supplying crafted menu_id (or modname) values through Modules.php, injecting an onmouseover handler that can steal session and CSRF tokens and let the attacker act as the administrator. Exploitation is gated by a hard prerequisite: a logged-in administrator must open the attacker's crafted link and interact with the injected element for the payload to execute in their session, which is why the CVSS 4.0 base score is 5.3 despite PR:N (user interaction is passive). The vendor addressed the flaw in version 12.9.2 (commit 08c871d wraps the reflected values in URLEscape()); no public exploit identified at time of analysis, and priority is triaged as this_month rather than emergency.
Missing authorization in RosarioSIS before 12.9.1 lets an authenticated teacher write referrals, eligibility codes, attendance entries and final grades for students outside their own course periods by submitting arbitrary student IDs to the save handlers MakeReferral.php, EnterEligibility.php, InputFinalGrades.php and TakeAttendance.php. The flaw requires valid teacher-level credentials (CVSS 4.0 base 5.3, PR:L) and is confined to record integrity within the same school - there is no confidentiality or availability impact and no anonymous attack path. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has released fix version 12.9.1.
Cross-site request forgery in RosarioSIS up to version 12.8 allows a remote unauthenticated attacker to trigger unintended state-changing actions in Modules.php by luring an authenticated user to a malicious page. The vulnerability stems from the absence of CSRF token validation on the modfunc parameter, compounded by insufficient sanitization of modfunc= in rendered HTML/Markdown output via MarkDownHTML.fnc.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-confirmed patch is available in v12.9.
Arbitrary database table row deletion in RosarioSIS up to version 12.7.4 allows authenticated users to issue DELETE statements against any table in the database by manipulating the unsanitized `table` parameter in `modules/Students/includes/Medical.inc.php`. While `DBEscapeIdentifier()` prevents classic SQL injection syntax escapes, it does not restrict which table is targeted - enabling destruction of records far beyond the medical module's intended scope, including user accounts, grades, or other critical school data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 12.8.
Authorization bypass via Insecure Direct Object Reference (IDOR) in RosarioSIS up to version 12.8 allows authenticated low-privilege users to manipulate numeric record IDs in HTTP requests to save or delete records belonging to other schools within the same multi-tenant installation. The vulnerability is program-wide, affecting at least Accounting, Attendance, and Discipline modules - not limited to Discipline/Referrals.php as the CVE description implies. A publicly available exploit exists (GitHub issue #301); the flaw is not in CISA KEV and CVSS 4.0 scores it at 2.1 with an active proof-of-concept modifier.
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Authenticated path traversal in RosarioSIS before version 12.9 lets any logged-in user (student, teacher, or staff) delete allow-listed files anywhere in the installation by inserting parent-directory ('../') sequences into the filename request parameter of the file-deletion functionality in the Users and Students modules. The impact is primarily integrity (I:H) with a limited availability effect (A:L), no confidentiality exposure, and no user interaction required, but exploitation is gated by a valid account (PR:L), so risk is moderate rather than critical. No public exploit code was identified at the time of analysis, and the issue is remediated by upgrading to 12.9.
Reflected cross-site scripting in RosarioSIS before 12.9.2 allows an unauthenticated attacker to break out of the double-quoted form action attribute on the Food_Service MenuReports page by supplying crafted menu_id (or modname) values through Modules.php, injecting an onmouseover handler that can steal session and CSRF tokens and let the attacker act as the administrator. Exploitation is gated by a hard prerequisite: a logged-in administrator must open the attacker's crafted link and interact with the injected element for the payload to execute in their session, which is why the CVSS 4.0 base score is 5.3 despite PR:N (user interaction is passive). The vendor addressed the flaw in version 12.9.2 (commit 08c871d wraps the reflected values in URLEscape()); no public exploit identified at time of analysis, and priority is triaged as this_month rather than emergency.
Missing authorization in RosarioSIS before 12.9.1 lets an authenticated teacher write referrals, eligibility codes, attendance entries and final grades for students outside their own course periods by submitting arbitrary student IDs to the save handlers MakeReferral.php, EnterEligibility.php, InputFinalGrades.php and TakeAttendance.php. The flaw requires valid teacher-level credentials (CVSS 4.0 base 5.3, PR:L) and is confined to record integrity within the same school - there is no confidentiality or availability impact and no anonymous attack path. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has released fix version 12.9.1.
Cross-site request forgery in RosarioSIS up to version 12.8 allows a remote unauthenticated attacker to trigger unintended state-changing actions in Modules.php by luring an authenticated user to a malicious page. The vulnerability stems from the absence of CSRF token validation on the modfunc parameter, compounded by insufficient sanitization of modfunc= in rendered HTML/Markdown output via MarkDownHTML.fnc.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-confirmed patch is available in v12.9.
Arbitrary database table row deletion in RosarioSIS up to version 12.7.4 allows authenticated users to issue DELETE statements against any table in the database by manipulating the unsanitized `table` parameter in `modules/Students/includes/Medical.inc.php`. While `DBEscapeIdentifier()` prevents classic SQL injection syntax escapes, it does not restrict which table is targeted - enabling destruction of records far beyond the medical module's intended scope, including user accounts, grades, or other critical school data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 12.8.
Authorization bypass via Insecure Direct Object Reference (IDOR) in RosarioSIS up to version 12.8 allows authenticated low-privilege users to manipulate numeric record IDs in HTTP requests to save or delete records belonging to other schools within the same multi-tenant installation. The vulnerability is program-wide, affecting at least Accounting, Attendance, and Discipline modules - not limited to Discipline/Referrals.php as the CVE description implies. A publicly available exploit exists (GitHub issue #301); the flaw is not in CISA KEV and CVSS 4.0 scores it at 2.1 with an active proof-of-concept modifier.
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.