CVE-2021-45416

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

• Vendor: francoisjacquet
• Vendor Website: https://www.rosariosis.org/
• Affected Product: RosarioSIS
• Affected Versions: v8.2.1, however it is assumed earlier versions might be affected as well

---

Instructions to reproduce:

• Use RosarioSIS 8.2.1.
• Open the URL vulnerable to XSS: http://localhost/rosariosis/Modules.php?modname=misc/ChooseCourse.php&modfunc=choose_course&course_modfunc=search&last_year=&search_term=%22%20onfocus%3D%22alert%28%60XSS%60%29 (make sure to replace localhost/rosariosis with your web server's path)
• Note that this website needs to be opened in a popup, for example using the javascript window.open() method. A proof of concept code is available in this repo.

Cause

User-supplied input in the search_term parameter is improperly neutralized in the modules/Scheduling/Courses.php script, which is accessible through ChooseCourse.php and ChooseRequest.php as shown in the proof of concept that you can find in this repo.

Solution

Update to the latest version of RosarioSIS. This issue was fixed in version v8.3.