Description
RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu_id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
francoisjacquet rosariosis
Default version status: unaffected
0 to < 12.9.2affected12.9.2unaffected
References
- https://github.com/francoisjacquet/rosariosis/commit/08c871da7f9d8478e0e72d104b310b98630fc755 ↗
- https://gitlab.com/francoisjacquet/rosariosis/-/commit/08c871da7f9d8478e0e72d104b310b98630fc755 ↗
- https://github.com/francoisjacquet/rosariosis/blob/v12.9.1/modules/Food_Service/MenuReports.php#L315 ↗
- https://github.com/francoisjacquet/rosariosis ↗
- https://www.vulncheck.com/advisories/rosariosis-before-12.9.2-reflected-xss-via-menu-id-in-menureports-php ↗