Mitch311

**Name of the Vulnerable Software and Affected Versions** RosarioSIS versions prior to 12.9 **Description** A flaw in the `DBUpdate()` function within the Discipline/Referrals.php file allows for a remote authorization bypass. Authorization bypass occurs when a user can access functions or data they are not permitted to reach. **Recommendations** Update to version 12.9. As a temporary workaround, restrict access to the `DBUpdate()` function in the Discipline/Referrals.php file.

**Name of the Vulnerable Software and Affected Versions** RosarioSIS versions prior to 12.8 **Description** A SQL injection issue exists in the Student Medical Module within the `modules/Students/includes/Medical.inc.php` file. This flaw allows a remote attacker to execute unauthorized database queries by manipulating the `table` argument. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or modification of the database. **Recommendations** Update to version 12.8. As a temporary mitigation, restrict access to the Student Medical Module until the update is applied.

**Name of the Vulnerable Software and Affected Versions** RosarioSIS versions prior to 12.9 **Description** An issue exists in the processing of the `Modules.php` file that allows remote exploitation via cross-site request forgery, a technique where an attacker tricks a victim's browser into performing an unwanted action on a different website. **Recommendations** Upgrade to version 12.9.

**Name of the Vulnerable Software and Affected Versions** Dolibarr ERP CRM versions prior to 23.0.2 **Description** Improper authorization exists in the Leave Request REST API component. The issue is located in the `checkUserAccessToObject()` function within the `htdocs/holiday/class/api holidays.class.php` file, which allows a remote attacker to bypass authorization controls. **Recommendations** Update to version 23.0.2. As a temporary mitigation, restrict access to the Leave Request REST API component.