PT-2022-12164 · Unknown · Rosariosis

Published 2022-02-22 · Updated 2025-04-11 · CVE-2021-44567

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RosarioSIS versions prior to 7.6.1

Description An unauthenticated SQL Injection issue exists via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.

Recommendations For versions prior to 7.6.1, update to version 7.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable ProgramFunctions/PortalPollsNotes.fnc.php file until a patch is applied. Avoid using the votes parameter in the affected function until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-44567

GHSA-82RR-MQ4R-P4R3

Affected Products

Rosariosis

References · 15

• 🔥 https://exploit-db.com/exploits/52169 · Exploit
• 🔥 https://gitlab.com/francoisjacquet/rosariosis/-/issues/308 · Exploit
• https://osv.dev/vulnerability/GHSA-82rr-mq4r-p4r3 · Vendor Advisory
• https://gitlab.com/francoisjacquet/rosariosis/-/commit/e001430aa9fb53d2502fb6f036f6c51c578d2016 · Patch
• https://gitlab.com/francoisjacquet/rosariosis/-/commit/519af055a4fdc1362657d75bca76f9c95a081eaa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-44567 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44567 · Vendor Advisory
• https://gitlab.com/francoisjacquet/rosariosis · Note
• https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md#changes-in-761 · Note
• https://twitter.com/syedaquib77/status/1910785785466323235 · Twitter Post
• https://t.me/cvenotify/27652 · Telegram Post
• https://t.me/cibsecurity/38019 · Telegram Post
• https://t.me/cvenotify/27274 · Telegram Post
• https://t.me/cvenotify/27330 · Telegram Post
• https://twitter.com/syedaquib77/status/1910786534023852053 · Twitter Post