CVE-2020-37084

Katalog CVE

CVSS 7.2 · High EPSS 0,95%

Kerentanan Unrestricted Upload of File with Dangerous Type pada arox school erp pro. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

School ERP Pro 1.0 contains a remote code execution vulnerability that allows authenticated admin users to upload arbitrary PHP files as profile photos by bypassing file extension checks. Attackers can exploit improper file validation in pre-editstudent.inc.php to execute arbitrary code on the server.

Rincian

Terbit di NVD

3 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.exploit-db.com/exploits/48392 exploit · advisory pihak ketiga · vdb entry
• https://www.vulncheck.com/advisories/school-erp-pro-admin-profile-photo-upload-remote-code-execution-vulnerabi... advisory pihak ketiga
• https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate/ product
• https://web.archive.org/web/20200129123503/http://arox.in/ product