CVE-2022-32119
Published: 15 July 2022
Summary
CVE-2022-32119 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Arox School Erp Pro. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 6.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Arox School ERP Pro v1.0 contains multiple instances of unrestricted file upload flaws (CWE-434) that permit arbitrary file placement through the Add Photo handler in photogalleries.inc.php and the staff-import Excel routine in 1finance_master.inc.php. The issues affect the web-accessible components of this school-management application and carry a CVSS 3.1 score of 8.8.
An authenticated user with low-privileged network access can upload crafted files without server-side validation, resulting in remote code execution, data disclosure, or full system compromise on the underlying web server. The attack requires no user interaction and can be performed directly over HTTP.
Public references include a proof-of-concept repository that demonstrates the upload paths, but no vendor advisory, patch, or mitigation guidance is listed among the available sources. The associated EPSS score has remained flat at 0.1228 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53368
Vulnerability details
Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1finance_master.inc.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.