SQL Injection in RosarioSIS Affects Non-Student User Accounts

CVE-2026-121731

What is CVE-2026-121731?

RosarioSIS versions prior to 12.9 contain a SQL injection vulnerability that enables authenticated non-student users, such as parents, to manipulate SQL queries through the unquoted period_id parameter in StudentSummary.php. This security flaw allows attackers to execute payloads without using single quotes in IN() clauses, potentially extracting sensitive information like administrator password hashes and student records using time-based queries. Furthermore, the vulnerability could lead to unauthorized data modification through stacked SQL statements.

References