CVE-2026-116217 Details
Description
RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu_id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.
A reflected cross-site scripting vulnerability has been identified in RosarioSIS versions prior to 12.9.2. The issue resides in the MenuReports.php file within the Food_Service module. This vulnerability allows unauthenticated attackers to inject attributes through unescaped menu_id and modname parameters. Exploitation involves luring a logged-in administrator to click a crafted link that exploits the vulnerability, injecting an onmouseover handler into the menu_id parameter. This injection can steal session and CSRF tokens, enabling the attacker to act as the administrator.
Users can update to RosarioSIS version 12.9.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RosarioSIS | >= 0, < 12.9.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |