PT-2026-5840 · Unknown · School Erp Pro

Besim Altinok · Published 2026-02-03 · Updated 2026-02-10 · CVE-2020-37090

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions School ERP Pro version 1.0

Description School ERP Pro 1.0 has a file upload issue that permits students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts via the message attachment feature, leading to remote code execution on the server. The vulnerable feature is the message attachment functionality, which does not properly validate uploaded files. The affected API endpoint is the messaging system's file upload function. The vulnerable parameter is the file attachment, file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-37090

Affected Products

School Erp Pro

References · 8

• 🔥 https://exploit-db.com/exploits/48392 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37090 · Security Note
• https://osv.dev/vulnerability/CVE-2020-37090 · Vendor Advisory
• https://t.me/CVEtracker/43644 · Telegram Post
• https://vulncheck.com/advisories/school-erp-pro-remote-code-execution · Note
• https://t.me/cveNotify/151597 · Telegram Post
• https://web.archive.org/web/20200129123503/http://arox.in · Note
• https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate · Note