Executive brief
RosarioSIS is a student information system used by schools to manage administrative data and operations. A cross-site request forgery vulnerability in the Modules.php file allows an attacker to trick authenticated users into performing unintended actions, potentially leading to unauthorized modification of school records, settings, or user data.
Technical details
The vulnerability is a cross-site request forgery (CSRF) flaw affecting the processing of the Modules.php file in RosarioSIS up to version 12.8. The root cause is insufficient CSRF token validation on requests containing the modfunc= parameter in links. An attacker can craft a malicious web page that, when visited by an authenticated school administrator or staff member, causes their browser to execute unintended actions within RosarioSIS without their knowledge. The attack requires the victim to be logged into RosarioSIS and click on a malicious link or visit a crafted page. The vulnerability was patched in version 12.9 (commit 801a71272c82cf4bf695fdc5ed42a9b7511d124d) by removing the modfunc= parameter from links.
Affected products
- francoisjacquet RosarioSIS up to 12.8
Timeline
- 2026-08-14: disclosed
- 2026: patched: Version 12.9 includes the patch