francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be launched remotely. Upgrading to version 12.8 is able to resolve this issue. The name of the patch is 6234a0ee0124c0667c824693ac77164f18946ddf. Upgrading the affected component is recommended.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| francoisjacquet | RosarioSIS | 12.7.0; 12.7.1; 12.7.2; 12.7.3; 12.7.4 | 12.8 | Patch available | CNA |
- RosarioSIS Vendorfrancoisjacquet Affected 12.7.0; 12.7.1; 12.7.2; 12.7.3; 12.7.4 Fixed in 12.8 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* | — | — | francoisjacquet |
- cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* Versions — — ·francoisjacquet
Remediation
- Fix · CNA RosarioSIS (francoisjacquet) Fixed in 12.8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-19785
- 2026-10-03 Alias added: GHSA-4g9f-3jh3-h27m
References
More francoisjacquet vulnerabilities
- TI-2021-20041 An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka… CVSS 3.1CRITICAL 9.8
- TI-2023-00941 Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis CVSS 3.1HIGH 7.5
- TI-2026-62651 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter CVSS 4.0HIGH 7.1
- TI-2021-20153 An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the… CVSS 3.1CRITICAL 9.8
- TI-2023-14071 RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. CVSS 3.1MEDIUM 5.4
- TI-2026-80079 Missing authorization in RosarioSIS teacher save handlers CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-19785 · CVE Program
- CVE-2026-19785 · NVD
- FIRST EPSS
- GHSA-4g9f-3jh3-h27m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences