CVE-2020-37088

概要

参考情報

• web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate · Product
• web.archive.org/web/20200129123503/http://arox.in · Product
• exploit-db.com/exploits/48394 · Exploit
• vulncheck.com/advisories/school-erp-pro-arbitrary-file-read · Third Party Advisory

school erp pro のその他の脆弱性

• CVE-2020-37084高 7.2School ERP Pro 1.0 contains a remote code execution vulnerability that allows authenticated admin users to upload arbitrary PHP files as pro…
• CVE-2020-37090緊急 9.8School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attacker…
• CVE-2020-37089緊急 9.8School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database quer…
• CVE-2022-32119高 8.8Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleri…
• CVE-2022-32118中 6.1Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory parameter in backoffi…