Read the docs
TI-2026-84852 Aliases CVE-2026-121731GHSA-97v2-f3v8-3cfx

SQL injection in RosarioSIS attendance absence report

Priority LOW 37CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

RosarioSIS before 12.9 contains an SQL injection flaw in the period_id parameter of StudentSummary.php, which is inserted into an IN() clause without quotes or escaping (CWE-89). An authenticated non-student user, including a parent, can send crafted input without single quotes to read administrator password hashes and student records through time-based queries, or to modify data using stacked statements.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.

Why it matters now

EPSS 0.00302 23rd percentileScored 2026-11-07
Fix Fixed RosarioSIS (francoisjacquet): 12.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
francoisjacquetRosarioSISbefore 12.912.9Patch availableCNA
  • RosarioSIS Vendorfrancoisjacquet Affected before 12.9 Fixed in 12.9 Patch available CNA

Remediation

Upgrade RosarioSIS to version 12.9 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA RosarioSIS (francoisjacquet) Fixed in 12.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    francoisjacquet RosarioSIS 12.9

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-84853 RosarioSIS billing flaw lets admins alter other schools' balancesPriority LOW 11
    Show all 2 records →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121731
  2. 2026-11-04 Alias added: GHSA-97v2-f3v8-3cfx
  3. 2026-11-05 Priority changed: MEDIUM → LOW

References

Patch 1

Other 4

  • TI-2021-20041 An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka… CVSS 3.1CRITICAL 9.8
  • TI-2023-00941 Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis CVSS 3.1HIGH 7.5
  • TI-2026-62651 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter CVSS 4.0HIGH 7.1
  • TI-2021-20153 An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the… CVSS 3.1CRITICAL 9.8
  • TI-2023-14071 RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. CVSS 3.1MEDIUM 5.4
  • TI-2026-80079 Missing authorization in RosarioSIS teacher save handlers CVSS 4.0MEDIUM 5.3
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences