← Zuruck zu CVEs

CVE-2020-37088

HIGH

7.5

Beschreibung

School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php. Attackers can access sensitive configuration files by supplying directory traversal paths to retrieve system credentials and configuration information.

CVE Details

CVSS v3.1 Bewertung7.5

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht2/3/2026

Zuletzt geandert2/10/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

arox:school_erp_pro

Schwachen (CWE)

CWE-22

Referenzen

https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate/(disclosure@vulncheck.com)

https://web.archive.org/web/20200129123503/http://arox.in/(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/48394(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/school-erp-pro-arbitrary-file-read(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.