CVE-2026-116217: RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php
RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menuid injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
RosarioSIS installations running a version before 12.9.2 are affected. Exploitation targets a logged-in administrator, because the injected script can steal that administrator's session and CSRF tokens.
What does an attacker need to exploit it?
The attacker does not need to authenticate, but must induce a logged-in administrator to open a crafted Modules.php link. The malicious request uses unescaped menu_id and modname parameters to inject an onmouseover handler.
Is direct interaction by an administrator required?
Yes. The attack requires user interaction: a logged-in administrator must be lured to the crafted link and trigger the injected handler, such as by hovering over the affected element.
What should be done if the deployment cannot be upgraded immediately?
The provided data identifies the vulnerable code path as modules/Food_Service/MenuReports.php and the affected parameters as menu_id and modname. Restricting or filtering untrusted requests containing these parameters to the affected Modules.php workflow can reduce exposure, but the data does not provide a validated workaround.