CVE-2020-15721: 
PHP vulnerability analysis and mitigation

RosarioSIS through version 6.8-beta contained a Cross-Site Scripting (XSS) vulnerability in modules/Custom/NotifyParents.php due to improper handling of href attributes in AddStudents.php and User.php. The vulnerability was discovered and disclosed on July 14, 2020 (NVD, MITRE).

The vulnerability exists due to insufficient sanitization of href attributes in AddStudents.php and User.php files within the NotifyParents.php module. The issue allows attackers to inject malicious scripts through these attributes. A fix was implemented by using URLEscape() function for links href attributes (GitLab Commit).

The XSS vulnerability could allow attackers to execute arbitrary web scripts or HTML code in the context of other users' browsers who access the affected pages. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (GitLab Issue).

The vulnerability can be exploited remotely by an attacker who can convince a user to access a specially crafted URL containing malicious JavaScript code in the href attributes. The attack requires user interaction to trigger the malicious script execution (GitLab Issue).

The vulnerability was fixed in the subsequent release after version 6.8-beta by implementing proper URL escaping for href attributes. Users should upgrade to the patched version to protect against this vulnerability (GitLab Commit).