Threats tagged 'ghsa-mfq4-wm65-76f5'

RosarioSIS versions prior to 12.9 have an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students from other schools. This occurs via manipulation of the student[] POST array in MassAssignFees.php and MassAssignPayments.php, enabling attackers to alter billing balances outside their authorized school scope.