CVE-2020-37089

概要

参考情報

• web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate · Product
• web.archive.org/web/20200129123503/http://arox.in · Product
• exploit-db.com/exploits/48390 · Exploit
• vulncheck.com/advisories/school-erp-pro-esmessagesid-sql-injection · Broken Link

school erp pro のその他の脆弱性

• CVE-2020-37084高 7.2School ERP Pro 1.0 contains a remote code execution vulnerability that allows authenticated admin users to upload arbitrary PHP files as pro…
• CVE-2020-37090緊急 9.8School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attacker…
• CVE-2020-37088高 7.5School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating th…
• CVE-2022-32119高 8.8Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleri…
• CVE-2022-32118中 6.1Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory parameter in backoffi…