RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report
Affects RosarioSIS before 12.9, with the reporter testing 12.8.1; authenticated non-student users such as parents can reach it through the Attendance Student Summary report. No vendor rating is given.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 12.9
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects RosarioSIS v12.8.1, the version the reporter tested Reachable by authenticated non-student users such as parents through the Attendance Student Summary report
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity8.7/10CVSS 8.7
- No patch0/5No signal
What would change the score
- Would score about 67 if added to CISA KEV
- Would score about 62 if CISA's SSVC rates exploitation active
- Would score about 24 if CISA's SSVC rates it automatable
CVE-2026-121731 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects RosarioSIS; fixed in 12.9.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 17/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 12.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
RosarioSIS, a free school information management system, is affected by this SQL injection flaw in its attendance absence report. Authenticated users with non-student roles, such as parents, could exploit it to read sensitive data like administrator password hashes and student records or to modify the database.
Read the original description
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.
What to do
Check whether your setup matches what the bug needs.
Affects RosarioSIS v12.8.1, the version the reporter tested Reachable by authenticated non-student users such as parents through the Attendance Student Summary reportUpgrade to a fixed version: 12.9.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- francoisjacquet RosarioSIS
fixed in 12.9
Evidence 6
- Patch
- Report
- Repository
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-121731
Is CVE-2026-121731 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The period_id value in the Attendance Absence Report is inserted into a database query without proper sanitizing, so a logged-in user can alter the SQL the application runs. The reporter showed this can expose the database name and the admin password hash, and can change data using stacked statements.Source: gitlab.com
Which versions are affected by CVE-2026-121731?
RosarioSIS: before 12.9.Source: cve.now feed data
Am I affected, and how do I check?
Versions before 12.9 are listed as affected, and the reporter tested 12.8.1. The issue is reachable by authenticated non-student users such as parents through the Attendance Student Summary report. To check a install, look at the RosarioSIS version shown in the application or its package records.Source: gitlab.com
How do I fix CVE-2026-121731?
Upgrade RosarioSIS to version 12.9 or later, which is the listed fixed version.Source: gitlab.com