A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass.
The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue.
Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
francoisjacquet:rosariosis
References 9
https://github.com/francoisjacquet/RosarioSIS/commit/04dd1a368ddf80ad7082baefa3…
cna@vuldb.com
https://github.com/francoisjacquet/RosarioSIS/issues/301
cna@vuldb.com
https://github.com/francoisjacquet/rosariosis/
cna@vuldb.com
https://github.com/francoisjacquet/rosariosis/issues/301
cna@vuldb.com
https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-19784
cna@vuldb.com
https://vuldb.com/submit/869367
cna@vuldb.com
https://vuldb.com/vuln/389744
cna@vuldb.com
https://vuldb.com/vuln/389744/cti
cna@vuldb.com