Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis

Vulnerability

Analysis CVE-2022-1997 is a stored cross-site scripting (XSS) vulnerability in RosarioSIS, a student information system, affecting versions prior to 9.0 [1]. The root cause lies in the PreparePHP_SELF.fnc.php file, which uses inline JavaScript from the URL without proper sanitization [3]. The fix addresses this by changing strpos to stripos for case-insensitive string filtering, removing malicious inline JavaScript from the URL [3].

Exploitation

An attacker with access to craft or influence a URL can inject arbitrary JavaScript code that becomes stored and executed when other users visit the affected page [2]. No authentication is explicitly required for the injection, though the attack surface is limited to user-controllable input processed by the PreparePHP_SELF function [2, 3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of a victim's browser, potentially leading to session hijacking, data theft, or defacement [2]. Because the XSS is stored, the malicious script persists and can affect multiple users without further interaction from the attacker [2].

Mitigation

The vulnerability is fixed in RosarioSIS version 9.0 [2]. The official commit [3] provides the necessary patch, and administrators are advised to update to the latest version or apply the commit manually.