CVE-2020-37084: School ERP Pro 1.0 Admin Profile Photo Upload Remote Code Execution Vulnerability

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-03 · updated 2026-06-17
Weakness: CWE-434

Description

School ERP Pro 1.0 contains a remote code execution vulnerability that allows authenticated admin users to upload arbitrary PHP files as profile photos by bypassing file extension checks. Attackers can exploit improper file validation in pre-editstudent.inc.php to execute arbitrary code on the server.

Affected products

Arox School ERP Pro: 1.0

References

https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate/
https://web.archive.org/web/20200129123503/http://arox.in/
https://www.exploit-db.com/exploits/48392
https://www.vulncheck.com/advisories/school-erp-pro-admin-profile-photo-upload-remote-code-execution-vulnerability

Get alerted when CVE-2020-37084 or the next vulnerability affects your stack