CVE-2020-37023
Published: 30 January 2026
Summary
CVE-2020-37023 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Koken CMS (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Koken CMS version 0.22.24 is affected by CVE-2020-37023, a file upload vulnerability that enables authenticated attackers to bypass file extension restrictions. By renaming malicious PHP files, attackers can upload payloads with system command execution capabilities through manipulated file upload requests, such as those proxied via a web proxy to alter the extension. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
Authenticated users with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity and no user interaction required. Successful exploitation allows attackers to achieve remote code execution by uploading and executing arbitrary PHP files, leading to high confidentiality, integrity, and availability impacts, such as full server compromise.
Advisories and references, including those from Vulncheck, Exploit-DB (exploit 48706), and a GitHub repository detailing the bypass, provide technical details on the issue but do not specify official patches in the available information. Security practitioners should consult the Koken CMS site and related resources for any updates or mitigation guidance.
Public proof-of-concept exploits are available on Exploit-DB and GitHub, indicating potential for real-world abuse, though no widespread exploitation has been reported in the provided data.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30953
Vulnerability details
Koken CMS 0.22.24 contains a file upload vulnerability that allows authenticated attackers to bypass file extension restrictions by renaming malicious PHP files. Attackers can upload PHP files with system command execution capabilities by manipulating the file upload request through a…
more
web proxy and changing the file extension.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows exploitation of a public-facing web application (T1190) via unrestricted file upload to deploy PHP web shells (T1100) for remote command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the Koken CMS file upload flaw allowing PHP extension bypasses, directly eliminating the vulnerability.
Enforces validation of file upload inputs beyond extensions to detect and reject malicious PHP payloads manipulated via proxies.
Deploys malicious code protection mechanisms at web upload entry points to scan and eradicate dangerous PHP files with command execution capabilities.