PT-2026-5839 · Unknown · School Erp Pro

Besim Altinok · Published 2026-02-03 · Updated 2026-02-10 · CVE-2020-37089

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions School ERP Pro version 1.0

Description School ERP Pro version 1.0 contains a SQL injection issue in the es messagesid parameter. Attackers can manipulate database queries through GET requests by injecting crafted SQL statements. This could allow attackers to extract, modify, or delete database information. The vulnerable parameter is accessible via GET requests.

Recommendations Apply a fix for School ERP Pro version 1.0 to address the SQL injection issue in the es messagesid parameter.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-37089

Affected Products

School Erp Pro

References · 8

• 🔥 https://exploit-db.com/exploits/48390 · Exploit
• https://osv.dev/vulnerability/CVE-2020-37089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-37089 · Security Note
• https://vulncheck.com/advisories/school-erp-pro-esmessagesid-sql-injection · Note
• https://t.me/cveNotify/151596 · Telegram Post
• https://web.archive.org/web/20200129123503/http://arox.in · Note
• https://t.me/CVEtracker/43643 · Telegram Post
• https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate · Note