CVE Intelligence
Analysis AI-assisted

CVE-2020-37089: Arox School ERP Pro 1.0 - SQL Injection via es_messagesid parameter

School ERP Pro 1.0 contains a SQL injection flaw in the es_messagesid parameter, reachable through GET requests. NVD scores it 9.8 under CVSS 3.1 and classifies it as CWE-89. The CISA KEV catalog does not list it, and the record includes no vendor fix.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

School ERP Pro 1.0 is reported to contain a SQL injection flaw (CWE-89) in the es_messagesid parameter, which can be reached through GET requests. The record states that this allows manipulation of database queries.

Impact

  • The record states that an attacker could potentially extract, modify or delete database information.
  • NVD scores the issue 9.8 (critical) under CVSS 3.1, with network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • A second CNA score from VulnCheck (8.2 under 3.1 and 7.1 under 4.0) is also present in the record. Scores differ by provider.

Affected products and versions

  • Product listed: Arox School Erp Pro, version 1.0.
  • No fixed version is listed in the record. This does not mean no fix exists, only that the consulted sources did not provide one.
  • Vendor pages referenced in the record are archived copies from 2019 and 2020, so the current availability of the product and vendor support are unknown.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog according to the record.
  • The record includes a public Exploit-DB entry tagged as an exploit. Public exploit availability raises the priority for review, but the record does not confirm exploitation in the wild.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify every deployment of School ERP Pro 1.0 or Arox School ERP Pro in your environment, including forgotten or legacy installations.
  • Because the record documents no vendor fix, consider removing the application or isolating it from untrusted networks until a supported version or a verified code correction is available.
  • If the code is maintained internally, use parameterized queries or prepared statements for all database access tied to the es_messagesid parameter, and validate input on the server side.
  • Use least-privilege database accounts so the application can perform only the operations it needs.
  • A web application firewall may reduce exposure as a temporary compensating control, but it should not replace a code correction.

Detection guidance

  • Review web server and application logs for unusual values in GET requests to the es_messagesid parameter, such as unexpected special characters or database error messages in responses.
  • Monitor database logs for errors or unexpected query patterns originating from the application account.
  • Alert on unexpected changes or deletions in message-related tables.

Limitations of the available information

  • The record does not list a vendor patch, fixed version or vendor advisory.
  • EPSS and SSVC data are not available in the record.
  • The VulnCheck advisory link is marked as broken in the record.
  • The affected code path, authentication requirements inside the application and deployment prevalence are not confirmed by the consulted sources.

Frequently asked questions

Is CVE-2020-37089 being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. A public Exploit-DB entry is referenced, which justifies prioritizing review.

Is there an official fix for this vulnerability?

The record does not list any fixed version or vendor patch. The absence of a fix in the record does not prove none exists, so teams should isolate or remove the product and check with the vendor or a maintainer.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.