CVE-2020-37022
MEDIUMOpenZ ERP 3.6.60 - Stored Cross-Site Scripting in Employee Module Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-37022. PoCs published by Vulnerability-Lab.
AI-analyzed exploit summary This exploit demonstrates a persistent XSS vulnerability in OpenZ ERP 3.6.60 via the `inpname` and `inpdescription` parameters in the Employee module. The PoC includes a crafted POST request with malicious iframe injection, which executes when viewed in the application.
Description
OpenZ ERP 3.6.60 contains a persistent cross-site scripting vulnerability in the Employee module's name and description parameters. Attackers can inject malicious scripts through POST requests to , enabling session hijacking and manipulation of application modules.
Exploits (1)
This exploit demonstrates a persistent XSS vulnerability in OpenZ ERP 3.6.60 via the `inpname` and `inpdescription` parameters in the Employee module. The PoC includes a crafted POST request with malicious iframe injection, which executes when viewed in the application.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N