CVE Intelligence
Analysis AI-assisted

CVE-2020-37090: School ERP Pro 1.0 - Unrestricted PHP File Upload in Messaging Attachments Leading to RCE

CVE-2020-37090 affects School ERP Pro 1.0, where the messaging attachment feature accepts arbitrary PHP files, as described in the record. The CNA-provided CVSS 3.1 score is 9.8 (critical), and the weakness is classified as CWE-434. No confirmed exploitation in the wild appears in the sources consulted, and no fixed version is listed in the record.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2020-37090 describes an unrestricted file upload weakness in School ERP Pro 1.0. According to the record, the message attachment feature of the messaging system accepts arbitrary PHP files, which can then be placed where the server may execute them. The weakness is classified as CWE-434, Unrestricted Upload of File with Dangerous Type.

Impact

  • The record states that the flaw enables remote code execution on the server.
  • The CNA-provided CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) corresponds to a score of 9.8, rated critical.
  • A CVSS 4.0 score of 8.7 is also listed by the same provider.
  • Successful exploitation could affect confidentiality, integrity and availability of the hosting system, based on the vector components.

Affected products and versions

  • Product listed in the record: Arox School Erp Pro, version 1.0. The description refers to the product as School ERP Pro 1.0.
  • The record does not list any fixed version or patch.
  • Other versions, forks or editions are not identified in the record.

Exploitation status

  • The KEV catalog entry shows that this CVE is not listed, so active exploitation is not confirmed by CISA KEV.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The reference list includes an Exploit-DB entry tagged as an exploit. Its presence indicates that public exploit material has been catalogued, which increases the importance of prompt remediation, but this portal does not describe or reproduce it.
  • EPSS and SSVC data are not available in the record.

Remediation and mitigation

  • No vendor fix is identified in the record. Organizations should confirm with the vendor or supplier whether a patched release exists before relying on any update.
  • If the product is in use, consider isolating or restricting access to the messaging feature and the upload directory until a fix or compensating control is in place.
  • Restrict the types of files accepted by the application, validate content server-side, and store uploads outside the web root or in locations where scripts are not executed.
  • Review and limit which accounts can use the messaging attachment function, particularly since the description refers to student users.
  • Where the product is no longer maintained, plan for replacement or decommissioning.

Detection guidance

  • Review upload and attachment directories for unexpected server-side script files, especially files with executable extensions that were not created by normal application workflows.
  • Monitor web server logs for requests to unusual file paths within upload directories and for unexpected outbound connections from the web server process.
  • Audit recent message attachment activity and correlate it with account activity.
  • Ensure file integrity monitoring covers the application directories.

Limitations of the available information

  • The record gives no fixed version, patch, or vendor advisory beyond third-party sources.
  • The affected product name differs slightly between the record title field and the description (Arox School Erp Pro versus School ERP Pro), and the title_en field in the record is empty.
  • The CVSS vector indicates no privileges are required (PR:N), while the description says students can perform the upload. Whether authentication is needed in practice is not clarified by the sources consulted.
  • The vendor's current status and support lifecycle are not documented in the record.
  • EPSS and SSVC data are unavailable.

Frequently asked questions

What is CVE-2020-37090?

It is an unrestricted file upload vulnerability in School ERP Pro 1.0 that allows arbitrary PHP files to be uploaded through the messaging attachment feature, according to the record.

How severe is it?

The CNA-provided CVSS 3.1 score is 9.8, rated critical, and a CVSS 4.0 score of 8.7 is also listed.

Is it known to be actively exploited?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

Is there a fixed version?

The record does not list any fixed version. Confirm with the vendor whether a patched release exists.

What should defenders do now?

Restrict or isolate the affected feature, limit accepted file types, keep uploads out of executable locations, and monitor upload directories and web server activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.