PT-2026-5834 · Unknown · School Erp Pro

Published 2026-02-03 · Updated 2026-02-10 · CVE-2020-37084

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions School ERP Pro version 1.0

Description School ERP Pro version 1.0 has a flaw that permits authenticated administrators to upload arbitrary PHP files as profile pictures, circumventing file extension validation. This is due to inadequate file validation within the pre-editstudent.inc.php file. An attacker can leverage this to execute code on the server. The vulnerable component is the file upload functionality for admin profile photos. The affected API endpoint is not explicitly mentioned. The vulnerable parameter is the profile photo upload field.

Recommendations Apply updates to address improper file validation in pre-editstudent.inc.php.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-37084

Affected Products

School Erp Pro

References · 9

• 🔥 https://exploit-db.com/exploits/48392 · Exploit
• https://osv.dev/vulnerability/CVE-2020-37084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-37084 · Security Note
• https://vulncheck.com/advisories/school-erp-pro-admin-profile-photo-upload-remote-code-execution-vulnerability · Note
• https://t.me/cveNotify/151598 · Telegram Post
• https://web.archive.org/web/20200129123503/http://arox.in · Note
• https://t.me/cveNotify/150803 · Telegram Post
• https://t.me/CVEtracker/43667 · Telegram Post
• https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate · Note