CVE-2026-121731 Details

A SQL injection vulnerability has been identified in RosarioSIS versions prior to 12.9. The issue allows authenticated non-student users, such as parents, to inject SQL through the unquoted 'period_id' parameter in 'StudentSummary.php' within the Attendance module. Exploitation of this vulnerability enables attackers to execute arbitrary SQL commands, potentially leading to the extraction of sensitive data like administrator password hashes and student records, or modification of database information. The vulnerability arises because user input is directly interpolated into SQL queries without proper sanitization or quoting, allowing for the injection of malicious payloads that exploit the application's SQL query handling.

Users are advised to upgrade to RosarioSIS version 12.9 or later, where this vulnerability has been patched. The patch involves casting the 'period_id' parameter to an integer before use and validating it against real period IDs fetched from the database.