RosarioSIS attendance report SQL injection via period_id
Parent accounts in this school program can steal student records and admin password hashes.
Summary
RosarioSIS before 12.9 has an SQL injection flaw in its attendance report. Authenticated non-student users, including parents, can extract administrator password hashes and student records or modify data.
Affected when
- Authenticated non-student user account, including parents
What to do
Update to 12.9. Back up your database before updating.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen