CVE-2020-37088highCWE-22

CVE-2020-37088: high-severity vulnerability in Arox School ERP Pro

School ERP Pro 1.0 - Arbitrary File Read

Published · Updated

Follow this CVE+ Monitor School ERP Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 2.8%
School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php. Attackers can access sensitive configuration files by supplying directory traversal paths to retrieve system credentials and configuration information.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Arox · School ERP Pro
Related CVEs — Arox School ERP Pro

In the same product, most dangerous first.

CVE-2020-37084HIGHSchool ERP Pro 1.0 Admin Profile Photo Upload Remote Code Execution VulnerabilityEPSS 1.0%CVE-2020-37090HIGHSchool ERP Pro 1.0 - Remote Code ExecutionEPSS 0.9%CVE-2020-37089HIGHSchool ERP Pro 1.0 - 'es_messagesid' SQL InjectionEPSS 0.4%