CyberRota Analysis
AI-GeneratedRosarioSIS versions prior to 12.9 are vulnerable due to inadequate validation of the filename request parameter in the Users and Students modules, enabling authenticated users to exploit path traversal vulnerabilities. This flaw allows attackers to manipulate file paths, potentially leading to the deletion of critical resources such as CSS, XML, and JSON files, as well as other users' documents across the system. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized file access and deletion.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.