Executive brief
RosarioSIS is a student information system used by schools to manage discipline referrals, billing, and grades. This vulnerability allows authenticated users with certain permissions to modify or delete records belonging to other students, teachers, or schools by directly manipulating record IDs. An attacker could change discipline referrals, delete student billing records, or modify grades without proper authorization checks.
Technical details
This is an Insecure Direct Object Reference (IDOR) vulnerability affecting multiple modules: Discipline/Referrals.php, Student_Billing/StudentFees.php, StudentPayments.php, and Grades/Assignments-new.php. The root cause is that view/list operations correctly scope data by school, student, and course period, but save/delete operations use only the record ID in their WHERE clauses without verifying the requesting user has access to the affected record. For example, Discipline/Referrals.php delete operations omit school year and school ID checks present in view operations. The vulnerability is remotely exploitable by any authenticated user with edit permissions in the affected modules. Attack preconditions require valid authentication and appropriate role-based access to the vulnerable functions. Upgrading to version 12.9 or applying patch 04dd1a368ddf80ad7082baefa3c656e4e1825c76 resolves the issue by adding proper scope verification to DELETE and UPDATE queries.
Affected products
- francoisjacquet RosarioSIS up to 12.8
Timeline
- 2026-03-01: disclosed
- 2026-04-27: patched
- 2026-08-14: advisory