{"id":"CVE-2026-116217","kind":"vulnerability","aliases":["CVE-2026-116217"],"related":[],"title":"RosarioSIS: reflected XSS in Food Service menu reports lets attackers hijack admin sessions","description":"RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu_id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.","summary":"RosarioSIS, a school information system, does not escape the menu_id and modname parameters in its Food Service menu reports page, so a crafted link injects an onmouseover handler into the page. A lured logged-in administrator's session and CSRF tokens can be stolen, letting the attacker act as that administrator.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","rosariosis","school-systems","self-hosted"],"not_affected_if":["food-service-module-unused","version-12.9.2-or-later"],"how_to_check":"- Check the installed version of RosarioSIS; versions before `12.9.2` are affected.\n- Look for `modules/Food_Service/MenuReports.php` in the installation and confirm whether menu_id and modname are escaped on output.","fix":"- Upgrade RosarioSIS to `12.9.2` or later.\n- Until upgraded, avoid clicking unfamiliar Modules.php links while logged in as an administrator.","status":"open","published_at":"2026-10-26T14:16:34+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:42+00:00","updated_at":"2026-10-26T14:32:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T14:32:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade RosarioSIS to `12.9.2` or later.\n- Until upgraded, avoid clicking unfamiliar Modules.php links while logged in as an administrator.","reach":"internet","title":"RosarioSIS: reflected XSS in Food Service menu reports lets attackers hijack admin sessions","impact":"high","summary":"RosarioSIS, a school information system, does not escape the menu_id and modname parameters in its Food Service menu reports page, so a crafted link injects an onmouseover handler into the page. A lured logged-in administrator's session and CSRF tokens can be stolen, letting the attacker act as that administrator.","category":"package","nicknames":[],"who_cares":["rosariosis","self-hosted","school-systems"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over an administrator's session and acts as them","analyst_note":"","how_to_check":"- Check the installed version of RosarioSIS; versions before `12.9.2` are affected.\n- Look for `modules/Food_Service/MenuReports.php` in the installation and confirm whether menu_id and modname are escaped on output.","needs_analyst":false,"not_affected_if":["version-12.9.2-or-later","food-service-module-unused"],"who_is_affected":"Any RosarioSIS deployment before 12.9.2 that exposes the Food Service module is exposed, since the flaw is in its menu reports page. The attack needs an administrator to open a crafted link while logged in, so deployments with no administrators using the web interface on the same network path carry less practical risk. Instances that do not run the Food Service module are not affected by this file.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3367,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116217':16A,19A '-2026':15A,18A '12.9.2':83C 'act':77B,137C 'admin':12A 'administr':65B,80B,115C,140C 'allow':95C 'attack':10A,76B,97C,108C 'attribut':100C 'contain':84C 'craft':51B,118C 'cross':88C 'cross-sit':87C 'csrf':69B,134C 'cve':14A,17A 'doubl':123C 'double-quot':122C 'escap':35B 'food':5A,44B 'handler':56B,130C 'hijack':11A 'host':27B 'id':38B,104C,126C 'inform':31B 'inject':53B,99C,127C 'let':9A,74B 'link':52B,120C 'log':63B,113C 'logged-in':62B,112C 'lure':61B,110C 'menu':7A,37B,46B,103C,125C 'modnam':40B,106C 'modules.php':119C 'modules/food_service/menureports.php':93C 'onmouseov':55B,129C 'packag':20B 'page':48B,59B 'paramet':41B,107C 'quot':124C 'reflect':2A,86C 'report':8A,47B 'rosariosi':1A,21B,28B,81C 'school':23B,30B 'school-system':22B 'script':90C 'self':26B 'self-host':25B 'servic':6A,45B 'session':13A,67B,132C 'site':89C 'steal':131C 'stolen':73B 'system':24B,32B 'token':70B,135C 'unauthent':96C 'unescap':102C 'via':101C 'vulner':91C 'whose':121C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Any RosarioSIS deployment before 12.9.2 that exposes the Food Service module is exposed, since the flaw is in its menu reports page. The attack needs an administrator to open a crafted link while logged in, so deployments with no administrators using the web interface on the same network path carry less practical risk. Instances that do not run the Food Service module are not affected by this file.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116217","severity":null,"published_at":"2026-10-26T14:16:34+00:00","modified_at":"2026-10-26T14:16:34+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}