CVE-2020-37084: School ERP Pro 1.0 RCE Vulnerability

CVE-2020-37084 Overview

School ERP Pro 1.0 contains a remote code execution vulnerability that allows authenticated admin users to upload arbitrary PHP files as profile photos by bypassing file extension checks. Attackers can exploit improper file validation in pre-editstudent.inc.php to execute arbitrary code on the server.

Critical Impact

Authenticated attackers with admin privileges can achieve full remote code execution on the server by uploading malicious PHP files disguised as profile photos, potentially leading to complete system compromise.

Affected Products

• School ERP Pro version 1.0
• PHP web applications utilizing the vulnerable pre-editstudent.inc.php component

Discovery Timeline

• 2026-02-03 - CVE CVE-2020-37084 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2020-37084

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw exists in the profile photo upload functionality within pre-editstudent.inc.php, where insufficient file type validation allows attackers to bypass extension restrictions. By crafting a malicious upload request, an authenticated administrator can upload PHP files that masquerade as legitimate image files.

Once a malicious PHP file is uploaded to the web server, the attacker can access it directly through the web interface, triggering server-side code execution. This grants the attacker the ability to run arbitrary commands with the privileges of the web server process, potentially leading to data exfiltration, lateral movement, or full server compromise.

Root Cause

The root cause of this vulnerability is improper input validation in the file upload handling code. The pre-editstudent.inc.php script fails to properly verify the content type and extension of uploaded files. Instead of implementing robust server-side validation that checks both the file extension and MIME type against an allowlist of image formats, the application relies on easily bypassable client-side checks or weak server-side validation that can be circumvented through techniques such as double extensions, null byte injection, or content-type manipulation.

Attack Vector

The attack requires network access and valid administrator credentials. An attacker first authenticates to the School ERP Pro administrative interface, then navigates to the student profile photo upload functionality. By intercepting the upload request and modifying the file extension or content-type headers, the attacker can upload a PHP webshell or other malicious script.

The vulnerability is particularly dangerous because:

1. The uploaded file is stored in a web-accessible directory
2. The PHP interpreter processes any .php files in that directory when accessed
3. The malicious code executes with the same privileges as the web server process

For detailed technical information about the exploitation mechanism, refer to the Exploit-DB #48392 and the VulnCheck Advisory.

Detection Methods for CVE-2020-37084

Indicators of Compromise

• Presence of unexpected PHP files in profile photo upload directories
• Web server logs showing access to unusual file names in image directories (e.g., .php files in /uploads/ or /photos/ paths)
• Suspicious POST requests to pre-editstudent.inc.php with unusual file extensions or MIME types
• Outbound connections from the web server to unknown external hosts

Detection Strategies

• Monitor file system events for creation of .php files in upload directories designated for images
• Implement web application firewall (WAF) rules to detect and block requests containing PHP file extensions in image upload endpoints
• Review web server access logs for requests to newly created files in upload directories
• Deploy file integrity monitoring (FIM) on web-accessible directories

Monitoring Recommendations

• Enable verbose logging for the School ERP Pro application to capture all file upload activities
• Configure alerts for any PHP file creation or modification in the profile photo storage directories
• Implement real-time log analysis to detect anomalous patterns in administrative actions
• Monitor for shell command execution patterns originating from the web server process

How to Mitigate CVE-2020-37084

Immediate Actions Required

• Restrict administrative access to only trusted users and implement multi-factor authentication
• Review and audit all files in upload directories for suspicious PHP content
• Implement network segmentation to limit the impact of potential server compromise
• Consider disabling the profile photo upload functionality until a patch is available

Patch Information

As of the last NVD update on 2026-02-04, vendor patch information is not available. Organizations should monitor the SourceForge Project Archive and Arox Website Archive for any security updates. Given the severity of this vulnerability, consider migrating to an actively maintained alternative if patches are not released promptly.

Workarounds

• Implement server-side file validation that checks both file extensions and actual file content (magic bytes)
• Configure the web server to prevent PHP execution in upload directories using .htaccess or equivalent configurations
• Rename uploaded files to random strings and store them outside the webroot with a separate retrieval mechanism
• Deploy a web application firewall (WAF) with rules to block malicious file uploads

# Apache configuration to prevent PHP execution in upload directory
# Add to .htaccess in the uploads folder
<FilesMatch "\.(php|php5|php7|phtml|phar)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Alternative: Disable PHP engine entirely in uploads directory
php_flag engine off