Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis

Root

Cause

RosarioSIS, a student information system, stored a cross-site scripting (XSS) vulnerability in versions prior to 8.9.3. The flaw lies in the lack of sanitization for SVG files during file upload. An attacker can craft an SVG containing malicious JavaScript, which is then stored and served to other users without proper filtering [1][2].

Exploitation

An authenticated user with file upload privileges can supply an SVG file that contains embedded JavaScript. When the SVG is later rendered in a browser (for example, in a user's profile or document viewer), the script executes in the context of the victim's session. No special network position is required beyond being able to upload files, and the vulnerability is classified as a stored XSS [1][3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who views the malicious SVG. This can lead to session hijacking, data theft, or defacement within the application. The CVSS score of 6.1 (Medium) reflects the need for some privileges and user interaction [1].

Mitigation

The vulnerability is fixed in RosarioSIS version 8.9.3, which disallows unsanitized SVG uploads [2]. Administrators should update to this version or later. No known exploitation in the wild is mentioned in the provided references, but users of prior versions should prioritize patching.