CVE-2020-37089highCWE-89

CVE-2020-37089: high-severity vulnerability in Arox School ERP Pro

School ERP Pro 1.0 - 'es_messagesid' SQL Injection

Published · Updated

Follow this CVE+ Monitor School ERP Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET requests. Attackers can exploit the vulnerable parameter by injecting crafted SQL statements to potentially extract, modify, or delete database information.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Arox · School ERP Pro
Related CVEs — Arox School ERP Pro

In the same product, most dangerous first.

CVE-2020-37088HIGHSchool ERP Pro 1.0 - Arbitrary File ReadEPSS 2.8%CVE-2020-37084HIGHSchool ERP Pro 1.0 Admin Profile Photo Upload Remote Code Execution VulnerabilityEPSS 1.0%CVE-2020-37090HIGHSchool ERP Pro 1.0 - Remote Code ExecutionEPSS 0.9%