Threats tagged 'ghsa-vm5w-pxvw-x49v'

RosarioSIS versions prior to 12.9.1 have a missing authorization vulnerability that allows authenticated teachers to modify records for students outside their assigned course periods. By manipulating specific POST parameters in several PHP scripts, attackers can create or alter referrals, eligibility codes, attendance, and final grades for any student in the school.