CVE-2020-37090highCWE-434

CVE-2020-37090: high-severity vulnerability in Arox School ERP Pro

School ERP Pro 1.0 - Remote Code Execution

Published · Updated

Follow this CVE+ Monitor School ERP Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.9%
School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Arox · School ERP Pro
Related CVEs — Arox School ERP Pro

In the same product, most dangerous first.

CVE-2020-37088HIGHSchool ERP Pro 1.0 - Arbitrary File ReadEPSS 2.8%CVE-2020-37084HIGHSchool ERP Pro 1.0 Admin Profile Photo Upload Remote Code Execution VulnerabilityEPSS 1.0%CVE-2020-37089HIGHSchool ERP Pro 1.0 - 'es_messagesid' SQL InjectionEPSS 0.4%