PT-2022-3964 · Arox · Arox School Erp Pro

Published 2022-05-31 · Updated 2022-07-22 · CVE-2022-32119

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Arox School ERP Pro version 1.0

Description The issue is related to the implementation of the Add Photo and Import Staff functions in the school management system, which allows for unlimited upload of dangerous file types. This can be exploited by a remote attacker to execute arbitrary code by uploading a specially crafted malicious file. The vulnerability is exploited through the "Add Photo" function at "photogalleries.inc.php" and the "import staff excel" function at "1finance master.inc.php".

Recommendations For Arox School ERP Pro version 1.0, consider disabling the Add Photo function and the import staff excel function until a patch is available to prevent exploitation. Restrict access to the "photogalleries.inc.php" and "1finance master.inc.php" files to minimize the risk of exploitation. Avoid using these functions until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2022-04797

CVE-2022-32119

Affected Products

Arox School Erp Pro

References · 11

• 🔥 https://github.com/JC175/CVE-2022-32119 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-32119 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32119 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04797 · Security Note
• https://github.com/anirudhmalik/xhunter · Note
• http://school.com · Note
• https://t.me/cibsecurity/46306 · Telegram Post
• http://arox.com · Note
• https://cybersecurity-help.cz/vdb/SB2022071908 · Note
• https://t.me/cybersecuritytechnologies/6417 · Telegram Post
• https://arox.in · Note