Skip to content
Threat Feed
Subscribe
high advisory

RosarioSIS: SQL injection in StudentSummary.php (CVE-2026-121731)

Authenticated non-student users can exploit an unquoted SQL injection vulnerability in RosarioSIS versions prior to 12.9 to extract sensitive data or modify records.

CVE search metadata

CVE search record: CVE-2026-121731. Severity: high. CVSS: 8.8. KEV: no. Product: RosarioSIS (< 12.9). Brief: RosarioSIS: SQL injection in StudentSummary.php (CVE-2026-121731). Brief link: https://feed.craftedsignal.io/briefs/2026-11-rosariosis-sql-injection/

Triage facts

Revision 1
Applicability
RosarioSIS (< 12.9)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 4, 00:24 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A2Roughly even chance

RosarioSIS versions before 12.9 contain a SQL injection vulnerability in the StudentSummary.php script. The vulnerability exists within the unquoted 'period_id' parameter, allowing authenticated non-student users, such as parents, to inject SQL payloads. Exploitation can lead to the exfiltration of sensitive information, including administrator password hashes and student records, via time-based queries or data modification through stacked statements.

Impact

Successful exploitation allows authenticated users to bypass intended access controls to read or modify database content, including sensitive student data and administrator credentials.

Recommendation

  • Upgrade to RosarioSIS 12.9 or later to remediate the vulnerable parameter handling in StudentSummary.php.
  • Review web access logs for requests to 'StudentSummary.php' containing abnormal characters or SQL keywords in the 'period_id' parameter.
  • Audit database logs for unusual SQL syntax or time-based delay commands originating from authenticated user accounts.

Immediate actions

Upgrade RosarioSIS to 12.9

IT Operations 48h

Threat Hunt

Identify authenticated sessions making repetitive or high-latency requests to StudentSummary.php

T1190 high medium confidence hunt now

Data: Web access logs (cs-uri-stem, cs-uri-query, request duration), Database slow query logs

Mitigations

Upgrade to RosarioSIS 12.9

immediate IT Operations

CVE-2026-121731

Detection coverage 1

Detect CVE-2026-121731 Exploitation - SQL Injection in StudentSummary.php

high

Detects attempts to exploit the SQL injection vulnerability in StudentSummary.php by monitoring for suspicious SQL keywords or syntax in the period_id parameter.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →