Reflected XSS in RosarioSIS MenuReports Module

Executive Summary

CVE-2026-116217 is a reflected cross-site scripting (XSS) vulnerability in RosarioSIS before version 12.9.2. It exists in the MenuReports.php file of the Food Service module. The issue occurs because user-supplied parameters like menu_id and modname are not properly escaped before being reflected in the HTML output. This allows attackers to inject malicious scripts, such as an onmouseover handler, into the page.

Useful 0 Not Useful 0

Detection Guidance

Check for unpatched versions of RosarioSIS below 12.9.2. Inspect MenuReports.php for unsanitized menu_id and modname parameters. Look for reflected XSS patterns in HTTP responses, such as onmouseover handlers or script tags in reflected input.

Useful 0 Not Useful 0

Impact Analysis

An attacker can trick a logged-in administrator into clicking a crafted link. This executes the injected script in the administrator's browser, stealing session tokens and CSRF tokens. The attacker can then impersonate the administrator, gaining full control over the application and its data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. It may result in data breaches, unauthorized disclosure, or modification of personal or health information, leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade RosarioSIS to version 12.9.2 or later. Apply input validation and output encoding to menu_id and modname parameters. Use URLEscape or similar functions to sanitize reflected parameters in MenuReports.php.

Useful 0 Not Useful 0