Description
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| francoisjacquet | RosarioSIS | < 12.9 | 12.9 |
References
- Patch Commit patch
- https://github.com/francoisjacquet/rosariosis product
- https://gitlab.com/francoisjacquet/rosariosis/-/issues/375 issue-tracking
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Attendance/includes/StudentSummary.php#L119 technical-description
- RosarioSIS v12.9 Release Notes release-notes
- VulnCheck Advisory: RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report third-party-advisory