Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis

Vulnerability

Overview

CVE-2022-2036 is a stored cross-site scripting (XSS) vulnerability in RosarioSIS, an open-source Student Information System, affecting all versions prior to 9.0.1 [1]. The root cause lies in the PreparePHP_SELF.fnc.php file, where the application fails to properly decode HTML entities from URL parameters before using them in output. Specifically, the html_entity_decode function was called without the ENT_QUOTES | ENT_HTML5 flags, leaving single quotes and other entities unescaped, which allowed attackers to break out of the intended context [3].

Exploitation and

Attack Surface

An attacker can exploit this vulnerability by crafting a malicious URL containing encoded HTML entities, such as ' (representing a single quote) or other JavaScript-payload sequences. When the application processes this URL, the insufficient decoding preserves the malicious content, which is then stored and later rendered in the context of another user's browser session [2]. No authentication is required for the initial injection point, but the stored payload will execute when any user (including administrators) views the affected page. The attack vector is network-based with low complexity [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, theft of sensitive data (e.g., student records, credentials), defacement of the application UI, or further attacks such as keylogging or redirecting users to malicious sites. Because the payload is stored, every subsequent visitor to the affected page is at risk, amplifying the impact across the organization [2].

Mitigation

The vulnerability was fixed in RosarioSIS version 9.0.1, released on or around June 9, 2022 [3]. The commit introduces proper entity decoding by adding the ENT_QUOTES | ENT_HTML5 flags to the html_entity_decode call, ensuring that all HTML entities (including single quotes) are correctly decoded and neutralized [3]. Administrators are strongly advised to upgrade to 9.0.1 or later. No workarounds are known; upgrading is the only reliable mitigation. This CVE has been catalogued by CISA's Known Exploited Vulnerabilities (KEV) list, emphasizing the need for immediate patching.