Goal Reached Thanks to every supporter โ€” we hit 100%!

Goal: 1000 CNY ยท Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2020-37090 โ€” AI Deep Analysis Summary

CVSS 9.8 ยท Critical

Q1What is this vulnerability? (Essence + Consequences)

๐Ÿšจ **Essence**: Arox School ERP Pro v1.0 has a critical **File Upload** flaw in the message attachment feature.โ€ฆ
Read full answer (login)

Q2Root Cause? (CWE/Flaw)

๐Ÿ›ก๏ธ **Root Cause**: **CWE-434** (Unrestricted Upload of File with Dangerous Type).โ€ฆ
Read full answer (login)

Q3Who is affected? (Versions/Components)

๐Ÿซ **Affected Vendor**: Arox. <br>๐Ÿ“ฆ **Product**: School ERP Pro. <br>๐Ÿ“Œ **Version**: **1.0** specifically. <br>โš ๏ธ **Component**: The **Message Attachment** functionality is the vulnerable entry point.

Q4What can hackers do? (Privileges/Data)

๐Ÿ’ป **Privileges**: **Remote Code Execution (RCE)**. <br>๐Ÿ“‚ **Data**: Full control over the server.โ€ฆ
Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

๐Ÿ”“ **Threshold**: **LOW**. <br>๐Ÿšซ **Auth**: **None required** (PR:N). <br>๐ŸŒ **Network**: Remote (AV:N). <br>๐ŸŽฏ **Complexity**: Low (AC:L). <br>๐Ÿ‘ค **User Interaction**: None (UI:N).โ€ฆ
Read full answer (login)

Q6Is there a public Exp? (PoC/Wild Exploitation)

๐Ÿ’ฃ **Public Exploit**: **YES**. <br>๐Ÿ“„ **Reference**: ExploitDB **48392** is available. <br>๐Ÿ”— **Advisory**: VulnCheck provides detailed advisory.โ€ฆ
Read full answer (login)

Q7How to self-check? (Features/Scanning)

๐Ÿ” **Self-Check**: <br>1. Scan for **Arox School ERP Pro v1.0**. <br>2. Check if the **Message Attachment** upload endpoint accepts **.php** or **.phtml** files. <br>3.โ€ฆ
Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

๐Ÿฉน **Official Fix**: The provided data does **not** list a specific patch version or commit. <br>๐Ÿ“… **Published**: 2026-02-03 (Note: Future date in data, treat as current advisory).โ€ฆ
Read full answer (login)

Q9What if no patch? (Workaround)

๐Ÿ›ก๏ธ **Workaround**: <br>1. **Disable** the message attachment feature entirely if not critical. <br>2. Implement **WAF rules** to block uploads of executable extensions (.php, .exe, .sh). <br>3.โ€ฆ
Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

๐Ÿšจ **Urgency**: **CRITICAL**. <br>๐Ÿ”ฅ **Priority**: **Immediate Action Required**. <br>๐Ÿ“‰ **CVSS**: 9.8 (Critical). <br>๐Ÿ’ก **Reason**: Unauthenticated RCE is one of the most dangerous vulnerabilities.โ€ฆ
Read full answer (login)

Continue exploring

Vulnerability detail Full AI analysis (login) Arox CWE-434