CVE-2021-44565

Vulnerability

A Cross-Site Scripting (XSS) vulnerability exists in RosarioSIS versions before 7.6.1, specifically in the xss_clean function in classes/Security.php. This function is used to sanitize user input in Markdown fields and other input areas, but it is based on an outdated CodeIgniter 2.1.3 filter that is susceptible to bypass. All Markdown input fields are affected [1][2].

Exploitation

An attacker can exploit this by crafting malicious input that bypasses the xss_clean filter. The proof of concept from [2] demonstrates that an admin user can log in, navigate to School_Setup/PortalNotes.php, and create a note containing malicious JavaScript or HTML. While the PoC uses admin, other user roles (students, teachers) may also be able to exploit the vulnerability in other parts of the application where the vulnerable function is used [2].

Impact

Successful exploitation allows a remote attacker to inject arbitrary JavaScript or HTML, leading to Cross-Site Scripting (XSS). This can result in session hijacking, website defacement, or redirection to malicious sites [1][2].

Mitigation

The vulnerability is fixed in RosarioSIS version 7.6.1, as indicated by the commit [3]. Users should upgrade to version 7.6.1 or later. No other workarounds are publicly documented.