CVE-2020-37089

School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET requests. Attackers can exploit the vulnerable parameter by injecting crafted SQL statements to potentially extract, modify, or delete database information.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - disclosure@vulncheck.com

Published

2026-02-03

Last modified

2026-03-05

Weaknesses

CWE-89

Affected products

• School Erp Pro (Arox)

References

• https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate/
• https://web.archive.org/web/20200129123503/http://arox.in/
• https://www.exploit-db.com/exploits/48390
• https://www.vulncheck.com/advisories/school-erp-pro-esmessagesid-sql-injection