📄 Description (English)
School ERP Pro 1.0 contains a remote code execution vulnerability that allows authenticated admin users to upload arbitrary PHP files as profile photos by bypassing file extension checks. Attackers can exploit improper file validation in pre-editstudent.inc.php to execute arbitrary code on the server.
🤖 AI Executive Summary
School ERP Pro 1.0 contains a critical remote code execution vulnerability allowing authenticated administrators to upload malicious PHP files by bypassing file extension validation. The vulnerability in pre-editstudent.inc.php enables arbitrary code execution on affected servers. With exploit code publicly available, this poses an immediate threat to educational institutions using this software.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 7, 2026 22:38
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability primarily affects Saudi educational institutions using School ERP Pro 1.0, including K-12 schools, universities, and private educational centers. Secondary impact extends to government education sector (Ministry of Education), healthcare institutions with educational divisions, and any organization managing student data through this platform. The vulnerability is particularly critical as it allows insider threats from administrative users and could lead to unauthorized access to sensitive student records, financial data, and institutional systems.
🏢 Affected Saudi Sectors
Education (K-12 and Higher Education)
Government (Ministry of Education)
Healthcare (institutions with educational divisions)
Private Educational Centers
Training and Development Organizations
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
8.2
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Identify all instances of School ERP Pro 1.0 in your environment
2. Restrict administrative access to the application immediately
3. Review access logs for pre-editstudent.inc.php for suspicious file uploads
4. Isolate affected systems from production networks if possible
PATCHING:
1. Apply the available patch from Arox immediately
2. Upgrade to School ERP Pro version 1.1 or later
3. Test patches in non-production environment first
4. Schedule maintenance window for production deployment
COMPENSATING CONTROLS (if patching delayed):
1. Implement strict file upload restrictions at web server level (disable PHP execution in upload directories)
2. Configure .htaccess or nginx rules to prevent PHP execution in profile photo directories
3. Implement Web Application Firewall (WAF) rules to block suspicious file uploads
4. Enable detailed logging for all file upload activities
5. Restrict admin user accounts to trusted IP addresses only
DETECTION:
1. Monitor for .php, .phtml, .php3, .php4, .php5 files in profile photo directories
2. Alert on any file uploads with mismatched MIME types
3. Review web server error logs for PHP execution attempts in upload directories
4. Implement IDS/IPS signatures for CVE-2020-37084 exploitation attempts
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تحديد جميع نسخ School ERP Pro 1.0 في بيئتك
2. تقييد الوصول الإداري للتطبيق فوراً
3. مراجعة سجلات الوصول لملف pre-editstudent.inc.php للبحث عن عمليات رفع ملفات مريبة
4. عزل الأنظمة المتأثرة عن شبكات الإنتاج إن أمكن
تطبيق التحديثات:
1. تطبيق التحديث المتاح من Arox فوراً
2. الترقية إلى School ERP Pro الإصدار 1.1 أو أحدث
3. اختبار التحديثات في بيئة غير الإنتاج أولاً
4. جدولة نافذة صيانة لنشر الإنتاج
الضوابط البديلة (إذا تأخر التصحيح):
1. تطبيق قيود صارمة على رفع الملفات على مستوى خادم الويب (تعطيل تنفيذ PHP في مجلدات التحميل)
2. تكوين قواعد .htaccess أو nginx لمنع تنفيذ PHP في مجلدات صور الملف الشخصي
3. تطبيق قواعد جدار حماية تطبيقات الويب (WAF) لحظر عمليات رفع الملفات المريبة
4. تفعيل السجلات التفصيلية لجميع أنشطة رفع الملفات
5. تقييد حسابات المستخدمين الإداريين على عناوين IP موثوقة فقط
الكشف:
1. مراقبة ملفات .php و .phtml و .php3 و .php4 و .php5 في مجلدات صور الملف الشخصي
2. تنبيه عند أي عمليات رفع ملفات بأنواع MIME غير متطابقة
3. مراجعة سجلات خادم الويب للبحث عن محاولات تنفيذ PHP في مجلدات التحميل
4. تطبيق توقيعات IDS/IPS لمحاولات استغلال CVE-2020-37084
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
A.12.2.1 - Change management procedures
A.14.2.1 - Secure development policy
A.14.2.5 - Secure development environment
A.12.6.1 - Management of technical vulnerabilities
🔵 SAMA CSF
ID.RA-1 - Asset management and vulnerability identification
PR.DS-6 - Data integrity and authenticity
DE.CM-8 - Vulnerability scans
🟡 ISO 27001:2022
A.12.2.1 - Change management
A.14.2.1 - Secure development policy
A.14.2.5 - Secure development environment
A.12.6.1 - Management of technical vulnerabilities
🟣 PCI DSS v4.0.1
6.2 - Security patches and updates
6.5.1 - Injection flaws
6.5.8 - Improper access control
🔗 References & Sources 4
🔗
https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-...
disclosure@vulncheck.com
Product
🔗
https://web.archive.org/web/20200129123503/http://arox.in/
disclosure@vulncheck.com
Product
🔗
https://www.exploit-db.com/exploits/48392
disclosure@vulncheck.com
Exploit
Third Party Advisory
VDB Entry
🔗
https://www.vulncheck.com/advisories/school-erp-pro-admin-profile-photo-upload-remote-c...
disclosure@vulncheck.com
Third Party Advisory
📦 Affected Products / CPE 1 entries
arox:school_erp_pro:1.0