CVE-2020-37090

School ERP Pro 1.0 - Remote Code Execution

School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server.

Affected

Arox · School ERP Pro

CVSS v4.0 VULNCHECK

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.90% chance of exploitation in the next 30 days, 59th percentile

Published

2026-02-03

Updated

2026-03-05

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/48392

Security advisories

• https://www.vulncheck.com/advisories/school-erp-pro-remote-code-execution
• https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ul…
• https://web.archive.org/web/20200129123503/http://arox.in

References

• CVE Record
• NVD entry