CVE-2020-15717
Description
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- RosarioSIS/RosarioSISdescription
- Range: =6.7.2
Patches
Vulnerability mechanics
Root cause
"Improper validation of user-supplied input in the `advanced` parameter of `Search.inc.php` allows reflected cross-site scripting."
Attack vector
A remote attacker crafts a URL containing malicious JavaScript in the `advanced` parameter (e.g., `advanced=1%22onmouseover%3d%22alert(\`xss\`)%22`) and tricks a victim into clicking it [ref_id=1]. When the victim's browser renders the page, the unsanitized parameter value is injected into the HTML, causing the attacker's script to execute in the victim's session context [ref_id=1]. The attack requires no authentication and is delivered over HTTP GET [ref_id=1].
Affected code
The vulnerability exists in `modules/Users/Search.inc.php`, `modules/Users/Preferences.php`, and `modules/Scheduling/PrintSchedules.php` [ref_id=1]. The `advanced` parameter in `Search.inc.php`, the `tab` parameter in `Preferences.php`, and the `include_inactive` parameter in `PrintSchedules.php` are echoed into HTML form `action` attributes without sanitization [ref_id=1].
What the fix does
The fix applies the `URLEscape()` function to user-supplied values before they are placed into form `action` attributes, as shown in the commit diff [ref_id=2]. For example, `echo '
Preconditions
- inputVictim must click a crafted URL or visit a page containing the malicious link
- authNo authentication required; the vulnerable endpoints are publicly accessible
Reproduction
1. Open a browser and navigate to: `http://RosarioSIS.edu/Modules.php?modname=Users/User.php&next_modname=Users/User.php&advanced=1%22onmouseover%3d%22alert(%60xss%60)%22` [ref_id=1]. 2. Hover over or interact with the injected element on the rendered page. 3. Observe that the JavaScript `alert('xss')` executes, confirming the reflected XSS [ref_id=1].
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- exchange.xforce.ibmcloud.com/vulnerabilities/184943mitrex_refsource_MISC
- gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.mdmitrex_refsource_MISC
- gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975amitrex_refsource_CONFIRM
- gitlab.com/francoisjacquet/rosariosis/-/issues/291mitrex_refsource_MISC
- gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-betamitrex_refsource_MISC
News mentions
0No linked articles in our index yet.