~ / search / GHSA-wf5p-f5xr-c4jj

GHSA-wf5p-f5xr-c4jj

SQL Injection in rosariosis

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-44427

Packages

EcosystemPackageAffectedFixed in
Packagist francoisjacquet/rosariosis < 8.1.1 8.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.

References

External links from the advisory. They lead to third-party sites.