RosarioSIS versions before 12.9.2 contain a reflected cross‑site scripting flaw in modules/Food_Service/MenuReports.php. Unescaped menu_id and modname parameters enable an attacker to inject arbitrary HTML attributes, such as an onmouseover handler. This flaw allows an unauthenticated attacker to lure a logged‑in administrator to a crafted link, which steals the administrator’s session cookie and CSRF token and then uses those credentials to act with administrative privileges. The weakness is a textbook example of CWE‑79."

The vulnerability affects the RosarioSIS application prior to version 12.9.2. Any deployment of RosarioSIS older than 12.9.2 that still uses the modules/Food_Service/MenuReports.php file is susceptible.

The vulnerability is scored 5.3 on the CVSS scale, indicating medium severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers do not need authentication to trigger the flaw; they merely need to supply crafted menu_id and modname GET parameters in a link that an administrator is willing to click. The exploited flow results in remote credential theft, effectively escalating privilege from an arbitrary attacker to an authenticated administrator.