RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Rosariosis Rosariosis
cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*
|
— |
12.9
|
References 4
https://gist.github.com/kazisabu/68bd095bc05b2341db318a063e05e644
NVD
https://gitlab.com/francoisjacquet/rosariosis/-/commit/701f9c07330157181362927a…
NVD
https://gitlab.com/francoisjacquet/rosariosis
NVD
https://www.vulncheck.com/advisories/rosariosis-before-12.9-path-traversal-in-f…
VulnCheck Advisory: RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter