CVE-2020-37090: School ERP Pro File Upload RCE Flaw

CVE-2020-37090 Overview

School ERP Pro 1.0 contains a critical file upload vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) that allows authenticated students to upload arbitrary PHP files through the messaging system. Attackers can exploit the message attachment feature to upload malicious PHP scripts, enabling remote code execution on the server.

Critical Impact
This vulnerability allows low-privileged users (students) to achieve remote code execution on the web server by uploading malicious PHP files through the messaging attachment feature, potentially compromising the entire school management system and sensitive student data.

Affected Products

School ERP Pro 1.0

Discovery Timeline

2026-02-03 - CVE CVE-2020-37090 published to NVD
2026-02-04 - Last updated in NVD database

Technical Details for CVE-2020-37090

Vulnerability Analysis

The vulnerability resides in School ERP Pro's messaging system, specifically in the file attachment handling functionality. The application fails to properly validate the file type and content of attachments uploaded through the messaging feature. This allows authenticated users, including those with low privileges such as students, to bypass intended file type restrictions and upload arbitrary PHP files.

Once a malicious PHP file is uploaded to the server, the attacker can directly access the uploaded file via a predictable or discoverable URL path, causing the web server to execute the PHP code. This grants the attacker the ability to run arbitrary commands on the underlying server with the privileges of the web server process.

The vulnerability is particularly severe in educational environments where student accounts are widely distributed and may be compromised or misused.

Root Cause

The root cause is improper input validation (CWE-434) in the file upload handling code within the messaging module. The application does not implement sufficient server-side validation to restrict file uploads to safe file types. Key deficiencies include:

No server-side validation of file extensions
Missing MIME type verification
Absence of content-type inspection
No restrictions on executable file types like .php, .phtml, or .php5

Attack Vector

The attack is network-based and requires low privileges (an authenticated student account). The attacker follows this exploitation path:

Authenticate to the School ERP Pro application using valid student credentials
Navigate to the messaging system's attachment upload feature
Craft a malicious PHP file containing web shell code or command execution payloads
Upload the PHP file as a message attachment, bypassing client-side restrictions
Locate the uploaded file path on the server (typically in a predictable uploads directory)
Access the uploaded PHP file directly via HTTP, triggering code execution
Execute arbitrary commands on the server

The vulnerability mechanism involves the server accepting and storing the uploaded PHP file without sanitization, then serving it in a way that allows PHP execution. For detailed technical information, refer to the Exploit-DB #48392 and the VulnCheck Remote Code Execution Advisory.

Detection Methods for CVE-2020-37090

Indicators of Compromise

Presence of unexpected .php, .phtml, or .php5 files in message attachment upload directories
Web server access logs showing direct requests to uploaded files in attachment folders
Unusual file creation timestamps in upload directories during non-business hours
Web shell signatures or command execution patterns in uploaded file contents

Detection Strategies

Monitor web server logs for POST requests to message attachment upload endpoints followed by GET requests to the same uploaded file
Implement file integrity monitoring on upload directories to detect new PHP file creation
Deploy web application firewall (WAF) rules to detect file upload attacks targeting PHP extensions
Review application logs for unusual attachment upload activity from student accounts

Monitoring Recommendations

Configure alerts for any PHP file writes to the messaging attachment directories
Monitor outbound connections from the web server that may indicate post-exploitation activity
Implement real-time log analysis for suspicious URL patterns accessing upload directories
Track student account activity for anomalous messaging behavior or high-volume attachments

How to Mitigate CVE-2020-37090

Immediate Actions Required

Restrict or disable the file attachment feature in the messaging system until a patch is applied
Implement server-side file type validation to block PHP and other executable file extensions
Configure the web server to prevent PHP execution in upload directories
Audit existing uploaded files in the attachment directory for malicious content
Consider migrating to a supported and actively maintained school management solution

Patch Information

No official vendor patch has been identified in the available CVE data. The original vendor (Arox) and the SourceForge project appear to be archived based on the Arox Website Archive and SourceForge Project Archive. Organizations using School ERP Pro 1.0 should implement workarounds immediately and consider migrating to an actively maintained alternative.

Workarounds

Add .htaccess rules or web server configuration to disable PHP execution in upload directories
Implement a whitelist of allowed file extensions (e.g., .pdf, .doc, .jpg, .png) at the server level
Store uploaded files outside the web root and serve them through a download script that sets appropriate headers
Apply network segmentation to limit the blast radius if the web server is compromised

bash

# Apache configuration to disable PHP execution in upload directories
# Add to .htaccess or httpd.conf for the uploads directory
<Directory "/var/www/html/school-erp/uploads">
    php_admin_flag engine off
    AddHandler default-handler .php .phtml .php5
</Directory>