PT-2026-5858 · Openclass+1 · Gunet Open Eclass+1

Emaragkos · Publicado 2026-02-03 · Atualizado 2026-02-12 · CVE-2020-37113

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GUnet OpenEclass version 1.7.3

Description GUnet OpenEclass version 1.7.3 allows authenticated users to bypass file extension restrictions during file uploads. An attacker can rename a PHP file to extensions like .php3 or .PhP to upload a web shell, leading to remote code execution. This bypass occurs because the file type checks in the exercise submission feature are not properly enforced. The vulnerable functionality involves bypassing intended file type checks.

Recommendations Apply updates to address the file extension restriction bypass in the exercise submission feature.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2020-37113

Produtos afetados

Gunet Open Eclass

Open Eclass Platform

Referências · 7

• 🔥 https://exploit-db.com/exploits/48163 · Exploit
• https://t.me/cveNotify/151858 · Publicação no Telegram
• https://vulncheck.com/advisories/gunet-openeclass-e-learning-platform-file-upload-extension-bypass · Nota
• https://openeclass.org · Nota
• https://osv.dev/vulnerability/CVE-2020-37113 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2020-37113 · Nota de Segurança
• https://download.openeclass.org/files/docs/1.7/CHANGES.txt · Correção