François Jacquet

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.

The issue concerns a Reflected Cross-Site Scripting vulnerability. This allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request.

The issue is caused by improper validation of user-supplied input by the Preferences.php script, allowing for XSS attacks. A remote attacker could exploit this using the `tab` parameter in a crafted URL, such as "/preferences.php?tab=".

The issue is caused by improper validation of user-supplied input by the Search.inc.php script, allowing for XSS attacks. A remote attacker could exploit this using the `advanced` parameter in a crafted URL, such as "/api/v1/search" or similar endpoints.

The issue is caused by improper validation of user-supplied input by the PrintSchedules.php script, allowing a remote attacker to exploit it using the `include inactive` parameter in a crafted URL.