Description

A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-14T03:16:20.717Z",
  "pubdate": "2026-08-14T03:16:20.717Z",
  "executiveSummary": "A security vulnerability has been identified in francoisjacquet RosarioSIS up to version 12.8, specifically involving unknown processing mechanisms within the file Modules.php. This vulnerability is classified as a Cross-Site Request Forgery (CSRF) flaw, enabling remote threat actors to induce unwitting users into executing unwanted actions on a web application in which they are currently authenticated. The presence of this defect introduces significant risk implications, as successful exploitation undermines application integrity and compromises user session security. Remote exploitation of the attack vector is entirely feasible without prior authentication to the malicious payload, provided the victim possesses an active authenticated session with the target RosarioSIS instance. The vendor has addressed this security limitation by releasing version 12.9 alongside a specific remedial patch identified by the cryptographic hash 801a71272c82cf4bf695fdc5ed42a9b7511d124d. Immediate upgrading of the affected software component is strongly recommended to eliminate the exposure window.",
  "technicalDetails": "The identified vulnerability resides within the francoisjacquet RosarioSIS application, specifically affecting indeterminate data processing routines handled by the Modules.php file across software iterations up to version 12.8. The root cause stems from an inadequate validation mechanism regarding state-changing requests, wherein the application fails to verify whether incoming HTTP requests originate from a legitimate user interaction or an unauthorized third-party site. This architectural oversight characterizes a standard Cross-Site Request Forgery (CSRF) vulnerability.\nExploitation of this flaw requires an interaction-based attack flow. A remote attacker crafts a malicious web page, external link, or embedded resource designed to generate a forged HTTP request directed toward the vulnerable Modules.php endpoint within the target RosarioSIS installation. When an authenticated user visits the attacker-controlled resource while maintaining an active session with RosarioSIS, the victim's browser automatically includes any valid, session-associated cookies or authentication tokens in the cross-site request.\nUpon receipt, the vulnerable server processes the incoming parameters within Modules.php under the security context of the authenticated victim, failing to recognize that the request was launched without the user's explicit intent or consent. Depending on the exact processing capabilities exposed by Modules.php, the post-exploitation impact allows the adversary to execute unauthorized administrative or standard user operations remotely. The network exposure is explicitly remote, requiring the attacker to deploy the exploit payload over the internet and leverage the victim's authenticated browser context as a proxy for internal application interaction. The vulnerability is entirely resolved in version 12.9, corresponding to the application of patch commit 801a71272c82cf4bf695fdc5ed42a9b7511d124d, which implements requisite request verification controls."
}