Description
School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Arox | School ERP Pro | 1.0 | — |
References
- ExploitDB-48392 exploit
- Archived Vendor Homepage product
- Archived SourceForge Product Page product
- VulnCheck Advisory: School ERP Pro 1.0 - Remote Code Execution third-party-advisory