critical9.8Public exploit code
CVE-2019-13294
AROX School-ERP Pro has a command execution vulnerability.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit)2019-06-17 · remote · php
Impact
AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthenticated user can execute a command on the system.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Arox | School-Erp | All versions |