SQL injection in francoisjacquet/rosariosis

CRITICAL 9.8CVE-2021-44567 · GHSA-82rr-mq4r-p4r3 · Published 24/02/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
francoisjacquet/rosariosis Packagist	`< 7.6.1`	`7.6.1`
rosariosis rosariosis	`< 7.6.1`	`7.6.1`

Description

An SQL Injection vulnerability exits in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.

NVD description

An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.

References

nvd.nist.gov/vuln/detail/CVE-2021-44567 · ADVISORY
gitlab.com/francoisjacquet/rosariosis · PACKAGE
gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md · WEB
gitlab.com/francoisjacquet/rosariosis/-/commit/519af055a4fdc1362657d75bca76f9c95a081eaa · WEB
gitlab.com/francoisjacquet/rosariosis/-/commit/e001430aa9fb53d2502fb6f036f6c51c578d2016 · WEB
gitlab.com/francoisjacquet/rosariosis/-/issues/308 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free