PT-2026-5839 · Unknown · School Erp Pro

Besim Altinok · Publicado 2026-02-03 · Atualizado 2026-02-10 · CVE-2020-37089

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions School ERP Pro version 1.0

Description School ERP Pro version 1.0 contains a SQL injection issue in the es messagesid parameter. Attackers can manipulate database queries through GET requests by injecting crafted SQL statements. This could allow attackers to extract, modify, or delete database information. The vulnerable parameter is accessible via GET requests.

Recommendations Apply a fix for School ERP Pro version 1.0 to address the SQL injection issue in the es messagesid parameter.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2020-37089

Produtos afetados

School Erp Pro

Referências · 8

• 🔥 https://exploit-db.com/exploits/48390 · Exploit
• https://vulncheck.com/advisories/school-erp-pro-esmessagesid-sql-injection · Nota
• https://osv.dev/vulnerability/CVE-2020-37089 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2020-37089 · Nota de Segurança
• https://t.me/cveNotify/151596 · Publicação no Telegram
• https://web.archive.org/web/20200129123503/http://arox.in · Nota
• https://t.me/CVEtracker/43643 · Publicação no Telegram
• https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate · Nota