PT-2026-5840 · Unknown · School Erp Pro

Besim Altinok · Publicado 2026-02-03 · Atualizado 2026-02-10 · CVE-2020-37090

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions School ERP Pro version 1.0

Description School ERP Pro 1.0 has a file upload issue that permits students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts via the message attachment feature, leading to remote code execution on the server. The vulnerable feature is the message attachment functionality, which does not properly validate uploaded files. The affected API endpoint is the messaging system's file upload function. The vulnerable parameter is the file attachment, file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2020-37090

Produtos afetados

School Erp Pro

Referências · 8

• 🔥 https://exploit-db.com/exploits/48392 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37090 · Nota de Segurança
• https://t.me/CVEtracker/43644 · Publicação no Telegram
• https://vulncheck.com/advisories/school-erp-pro-remote-code-execution · Nota
• https://t.me/cveNotify/151597 · Publicação no Telegram
• https://web.archive.org/web/20200129123503/http://arox.in · Nota
• https://osv.dev/vulnerability/CVE-2020-37090 · Aviso do Fabricante
• https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate · Nota