CVE-2020-15717

Name of the Vulnerable Software and Affected Versions RosarioSIS version 6.7.2

Description The issue is caused by improper validation of user-supplied input by the Search.inc.php script, allowing for XSS attacks. A remote attacker could exploit this using the advanced parameter in a crafted URL, such as "/api/v1/search" or similar endpoints.

Recommendations For RosarioSIS version 6.7.2, update the Search.inc.php script to properly validate user-supplied input, specifically the advanced parameter, to prevent XSS attacks. As a temporary workaround, consider restricting access to the Search.inc.php script until a patch is available.