CVE-2021-44427: RosarioSIS unauthenticated SQL injection in Side.php syear parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, an exploit-tagged reference and very high EPSS make this an urgent patch target.

What it is

Rosario Student Information System (rosariosis) before 8.1.1 passes the syear parameter in /Side.php into SQL without sanitization, allowing unauthenticated SQL injection. Because the endpoint is reachable without login, any remote attacker can run arbitrary PostgreSQL statements against the application database.

Impact

An attacker gains full read and write access to the underlying PostgreSQL database, including SELECT, INSERT, UPDATE and DELETE, which can expose or alter student, staff and administrative records. The CVSS vector rates confidentiality, integrity and availability all High.

Attack surface

Reached over the network via HTTP requests to /Side.php with a crafted syear parameter; the CVSS vector shows no privileges required and no user interaction, so no authentication is needed.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but the references are tagged Exploit and EPSS is 0.50641 (98.9th percentile), indicating a high likelihood of exploitation activity.

What to do

• Upgrade rosariosis to 8.1.1 or later, which is the fixed version per the advisory.
• If immediate upgrade is not possible, restrict network access to /Side.php and the application to trusted networks or a VPN.
• Apply input validation or parameterized queries to the syear parameter as a temporary code-level fix.
• Run the application database account with least privilege so injected statements cannot reach unrelated schemas or functions.
• Review database and web logs for prior exploitation attempts before patching.

Detection

• Inspect web server and WAF logs for requests to /Side.php with unusual or malformed syear values, including SQL keywords, quotes or comment markers.
• Enable PostgreSQL statement logging and look for unexpected SELECT, INSERT, UPDATE or DELETE statements originating from the web application account.
• Alert on database errors or anomalous query volume from the rosariosis application host.
• Monitor for outbound or lateral activity from the database server that could indicate data exfiltration after injection.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.