CVE-2020-37090
Arox School Erp Pro 1.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2020-37090 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Arox School Erp Pro. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
School ERP Pro 1.0 suffers from a file upload vulnerability in its messaging system, classified as CVE-2020-37090 and mapped to CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw allows authenticated users, such as students, to upload arbitrary PHP files through the message attachment feature. This leads to remote code execution (RCE) on the server, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and lack of prerequisites.
Any remote attacker with network access can exploit this vulnerability without authentication privileges, as indicated by the CVSS metrics. By uploading a malicious PHP script via the messaging attachment, the attacker gains the ability to execute arbitrary code on the server, potentially compromising confidentiality, integrity, and availability through full system control.
Advisories and references, including those from Exploit-DB (exploit 48392) and Vulncheck, document the vulnerability and provide proof-of-concept exploits demonstrating the RCE. Archived project pages on SourceForge and the vendor site (arox.in) highlight the affected School ERP Pro 1.0 software, but no specific patches or mitigations are detailed in the available information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31005
Vulnerability Data
School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote code execution through unrestricted file upload of PHP scripts in a public-facing web application (School ERP Pro messaging system), directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of uploaded files in the messaging system to reject arbitrary PHP scripts and prevent RCE.
Restricts information inputs to safe file types only, blocking uploads of dangerous PHP files through message attachments.
Employs malicious code protection mechanisms to scan and block PHP shells in uploaded message attachments before execution.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.
Hardened configuration baselines can enforce allowed file types and processing rules.
Secure development practices include input validation and file-type restrictions that prevent this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Configuration and acceptance testing verify that file-upload handling enforces allowed types and does not permit dangerous content to be stored or executed.
Secure-coding guidelines and security testing explicitly address restrictions on allowed file types and upload handling, reducing the risk that dangerous file uploads are accepted without validation.
Mandated testing for malicious content and known vulnerabilities reduces the likelihood that an outsourced component will contain or accept dangerous file types that could later be uploaded or executed.
Application allow-listing and pre-use scanning of received files directly blocks the introduction of executable content that has not been vetted, eliminating the primary vector for unrestricted dangerous file uploads.