Description

A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be launched remotely. Upgrading to version 12.8 is able to resolve this issue. The name of the patch is 6234a0ee0124c0667c824693ac77164f18946ddf. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-14T03:16:20.547Z",
  "pubdate": "2026-08-14T03:16:20.547Z",
  "executiveSummary": "An SQL injection vulnerability has been identified in francoisjacquet RosarioSIS up to version 12.7.4 within the Student Medical Module. Specifically, the flaw exists in the file modules/Students/includes/Medical.inc.php via the manipulation of the table argument. This security defect allows remote attackers to inject malicious SQL commands into database queries, potentially leading to unauthorized data access, modification, or destruction. The vulnerability introduces significant risk to confidentiality, integrity, and availability of the underlying database. Exploitation can be executed remotely over the network against affected deployments. Remediation requires upgrading to version 12.8 or applying the official patch referenced by the commit identifier 6234a0ee0124c0667c824693ac77164f18946ddf. No specific complex exploitation requirements are documented other than network reachability to the vulnerable endpoint.",
  "technicalDetails": "The vulnerability resides in the Student Medical Module of RosarioSIS, specifically within the source file modules/Students/includes/Medical.inc.php. The root cause of the vulnerability stems from improper neutralization of user-supplied input before it is concatenated or used directly within database query execution structures. Specifically, the argument designated as table is improperly validated, sanitized, or parameterized.\nDuring execution, the application accepts user input through the table parameter and dynamically incorporates this data into SQL statements executed by the database management system. Because the application fails to enforce strict input filtering or employ parameterized queries for this database interaction, an attacker can supply specially crafted strings containing SQL syntax.\nThe attack flow proceeds as follows: First, the remote adversary crafts an HTTP request targeting the vulnerable modules/Students/includes/Medical.inc.php component. Within this request, the adversary injects malicious SQL payloads via the table argument. Second, the application processes the input and constructs the dynamic SQL query without adequate escaping or parameterization. Third, the database server evaluates the resulting malicious query string, executing the injected commands within the context of the database user account.\nThis vulnerability is classified as a SQL injection (SQLi) flaw. Depending on database permissions and underlying database structures, successful exploitation can lead to severe post-exploitation impacts, including unauthorized extraction of sensitive student medical records, enumeration of database contents, bypass of authentication mechanisms, or potential execution of administrative database operations. The affected software versions include all RosarioSIS deployments up to version 12.7.4."
}