CVE-2020-37082: webERP Information Disclosure Flaw

CVE-2020-37082 Overview

webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file. This vulnerability is classified as CWE-552 (Files or Directories Accessible to External Parties).

Critical Impact

Remote attackers can download complete database backups containing sensitive business data, user credentials, financial records, and other confidential information without requiring any authentication.

Affected Products

• webERP 4.15.1
• webERP versions prior to 4.15.1 (potentially affected)
• Any deployment exposing the companies/weberp/ directory to web access

Discovery Timeline

• 2026-02-03 - CVE CVE-2020-37082 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2020-37082

Vulnerability Analysis

This vulnerability stems from improper access control on database backup files generated by webERP. The application creates compressed SQL backup files (.sql.gz) in a predictable location within the web-accessible directory structure. The backup files follow a naming convention of Backup_[timestamp].sql.gz, which makes them discoverable through enumeration or direct access attempts.

The flaw allows any unauthenticated remote attacker with network access to the webERP installation to retrieve these backup files. Since database backups typically contain complete application data—including user credentials, customer information, financial transactions, inventory data, and system configurations—successful exploitation can lead to catastrophic data breaches.

Root Cause

The root cause of this vulnerability is the storage of sensitive backup files in a publicly accessible directory (companies/weberp/) without implementing proper access controls. The application fails to:

1. Restrict access to the backup directory through web server configuration
2. Implement authentication checks before serving backup files
3. Store backups outside the web-accessible document root
4. Use unpredictable file naming or access tokens for backup retrieval

Attack Vector

Exploitation of this vulnerability is straightforward and requires minimal technical skill. An attacker with network access to the webERP installation can directly request backup files from the vulnerable path. The attack can be performed using any HTTP client, web browser, or automated scanning tool.

The attack process involves identifying webERP installations through fingerprinting, then attempting to access the backup directory. If backups exist, the attacker can download them by guessing or enumerating the timestamp portion of the filename. Successful exploitation provides the attacker with a complete copy of the application database, which can be analyzed offline to extract sensitive information.

Detection Methods for CVE-2020-37082

Indicators of Compromise

• Unusual HTTP requests to the companies/weberp/ directory path
• Multiple requests for .sql.gz files from external IP addresses
• HTTP 200 responses for backup file requests from unauthenticated sessions
• Increased outbound data transfer from the web server

Detection Strategies

• Monitor web server access logs for requests targeting Backup_*.sql.gz files
• Implement file integrity monitoring on the backup directory to detect unauthorized access
• Configure web application firewall (WAF) rules to alert on requests to sensitive file extensions in the backup path
• Deploy network intrusion detection signatures for webERP backup file access patterns

Monitoring Recommendations

• Enable detailed access logging for the companies/ directory and subdirectories
• Set up alerts for any successful (HTTP 200) responses to backup file requests
• Review access logs periodically for evidence of directory enumeration attempts
• Monitor for requests containing timestamp patterns typical of backup filenames

How to Mitigate CVE-2020-37082

Immediate Actions Required

• Restrict access to the companies/weberp/ directory using web server configuration (e.g., .htaccess for Apache or location blocks for Nginx)
• Move existing backup files to a location outside the web document root
• Implement authentication requirements for any backup-related functionality
• Review access logs to determine if backup files have been accessed by unauthorized parties

Patch Information

No official vendor patch information is currently available in the CVE data. Organizations should consult the webERP official website and SourceForge project page for security updates. Additional technical details can be found at the VulnCheck Weberp Advisory and Exploit-DB #48420.

Workarounds

• Block public access to the backup directory using web server deny rules
• Store database backups in a secure location outside the webroot (e.g., /var/backups/weberp/)
• If backups must remain accessible, implement authentication via .htpasswd or equivalent mechanism
• Consider using network segmentation to limit access to the webERP application

# Apache .htaccess example to deny access to backup directory
# Place in companies/weberp/.htaccess
<FilesMatch "\.sql\.gz$">
    Require all denied
</FilesMatch>

# Nginx configuration example
# Add to server block
location ~* /companies/weberp/.*\.sql\.gz$ {
    deny all;
    return 403;
}