CVE-2020-37113: GUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension Bypass
GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attacker can upload a web shell and execute arbitrary code on the server. This vulnerability enables remote code execution by bypassing the intended file type checks in the exercise submission feature.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37113?
CVE-2020-37113 has a moderate severity rating, as it allows authenticated users to bypass file upload restrictions.
How do I fix CVE-2020-37113?
To fix CVE-2020-37113, ensure strict validation of uploaded file types and implement proper security measures to prevent execution of unauthorized scripts.
Who is affected by CVE-2020-37113?
CVE-2020-37113 affects users of GUnet OpenEclass version 1.7.3 who have the ability to upload files.
What kind of attacks can CVE-2020-37113 enable?
CVE-2020-37113 can enable attackers to upload malicious PHP scripts disguised as other file types, allowing arbitrary code execution on the server.
Is CVE-2020-37113 a remote exploit?
CVE-2020-37113 can be exploited remotely by authenticated users, making it a critical security concern for affected systems.