CVE-2020-15716

Name of the Vulnerable Software and Affected Versions RosarioSIS version 6.7.2

Description The issue is caused by improper validation of user-supplied input by the Preferences.php script, allowing for XSS attacks. A remote attacker could exploit this using the tab parameter in a crafted URL, such as "/preferences.php?tab=".

Recommendations For RosarioSIS version 6.7.2, update the Preferences.php script to properly validate user-supplied input to prevent XSS attacks. As a temporary workaround, consider restricting access to the Preferences.php script until a patch is available. Avoid using the tab parameter in crafted URLs until the issue is resolved.