Vulnerability · Published Feb 3, 2026 · Assigned by VulnCheck
CVE-2020-37089School ERP Pro 1.0 - 'es_messagesid' SQL Injection
High 8.2
In plain English
A high-severity SQL injection in School ERP Pro from Arox. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.4%top 65.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET requests. Attackers can exploit the vulnerable parameter by injecting crafted SQL statements to potentially extract, modify, or delete database information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arox | School ERP Pro | 1.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- ExploitDB-48390 exploit
- Archived Vendor Homepage product
- Archived SourceForge Product Page product
- VulnCheck Advisory: School ERP Pro 1.0 - 'es_messagesid' SQL Injection third-party-advisory