Threats affecting pkg:github/francoisjacquet/rosariosis

RosarioSIS versions prior to 12.9 have an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students from other schools. This occurs via manipulation of the student[] POST array in MassAssignFees.php and MassAssignPayments.php, enabling attackers to alter billing balances outside their authorized school scope.

RosarioSIS versions prior to 12.9 contain a SQL injection vulnerability in the StudentSummary.php component. This flaw allows authenticated non-student users, such as parents, to inject SQL code via the unquoted period_id parameter. Exploitation can lead to unauthorized extraction of administrator password hashes and student records or modification of data through stacked SQL statements.

RosarioSIS versions prior to 12.9.2 contain a reflected cross-site scripting (XSS) vulnerability in the MenuReports.php module. This flaw allows unauthenticated attackers to inject malicious attributes via the menu_id and modname parameters. By tricking a logged-in administrator into clicking a crafted link, attackers can execute JavaScript that steals session and CSRF tokens, potentially enabling administrative actions.

RosarioSIS versions prior to 12.9.1 contain an authorization bypass vulnerability that allows authenticated teachers to modify records for students outside their assigned course periods. By supplying arbitrary student IDs in specific POST arrays, attackers can create or alter referrals, eligibility codes, attendance, and final grades for any student in the school.

CVE-2026-19786 is a cross-site request forgery (CSRF) vulnerability in francoisjacquet RosarioSIS affecting versions up to 12.8. The issue involves improper processing in the Modules.php file that allows remote attackers to perform unauthorized actions via CSRF. Upgrading to version 12.9 addresses this vulnerability. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be launched remotely. Upgrading to version 12.8 is able to resolve this issue. The name of the patch is 6234a0ee0124c0667c824693ac77164f18946ddf. Upgrading the affected component is recommended.

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.