CVE-2022-32119
📋 TL;DR
Arox School ERP Pro v1.0 contains multiple arbitrary file upload vulnerabilities that allow attackers to upload malicious files to the server. This affects all users running the vulnerable version of the software, potentially leading to remote code execution.
💻 Affected Systems
- Arox School ERP Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Webshell upload allowing persistent access, data exfiltration, and further exploitation of the server.
If Mitigated
File uploads blocked or properly validated, limiting impact to denial of service if upload attempts occur.
🎯 Exploit Status
Exploitation requires authentication but is straightforward once authenticated. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
File Upload Restriction
allImplement strict file upload validation in photogalleries.inc.php and 1finance_master.inc.php
Add file type validation: only allow image files (jpg, png, gif) for photo uploads
Add file extension validation: block executable extensions (php, exe, sh, etc.)
Implement file content verification using magic bytes
Access Control
allRestrict access to vulnerable functions to authorized users only
Add authentication checks before file upload processing
Implement role-based access control for administrative functions
🧯 If You Can't Patch
- Disable the vulnerable functions (Add Photo and import staff excel) if not essential
- Implement web application firewall rules to block file uploads with suspicious extensions
🔍 How to Verify
Check if Vulnerable:
Check if running Arox School ERP Pro v1.0 and test file upload functionality with malicious filesCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Attempt to upload files with executable extensions and verify they are rejected📡 Detection & Monitoring
Log Indicators:
- Multiple failed file upload attempts
- Uploads of files with executable extensions
- Unusual file uploads to photogalleries or finance modules
Network Indicators:
- POST requests to photogalleries.inc.php or 1finance_master.inc.php with file uploads
- Unusual outbound connections from web server
SIEM Query:
source="web_server" AND (uri="*photogalleries.inc.php*" OR uri="*1finance_master.inc.php*") AND method="POST" AND size>1000000