CVE-2026-121731: RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted periodid parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated non-student user can exploit it, including parent accounts. No user interaction is required.
Are default deployments affected?
Deployments running RosarioSIS before 12.9 are affected if non-student users can access the Attendance Absence Report functionality.
What can an attacker do through the injection?
An attacker can use time-based queries to extract administrator password hashes and student records. The issue may also allow data modification through stacked SQL statements.
What should be prioritized for remediation?
Upgrade RosarioSIS to version 12.9 or later. Until upgrading is possible, restrict untrusted non-student accounts, particularly parent accounts, from accessing the Attendance Absence Report.