CVE-2020-37089 is a SQL injection in School ERP Pro 1.0 from Arox, scored 8.2 (high). The es_messagesid parameter, sent in a GET request, is used in a database query unsafely. The record names no patched version, so restrict access now and check with the vendor for an update.
What's affected
The record lists School ERP Pro 1.0 by arox. The vulnerable parameter is es_messagesid, delivered in GET requests. The record says an attacker could extract, modify or delete database information.
The CVSS vector is AV:N/AC:L/PR:N/UI:N. No fixed version appears in the record, and the reference links are archived copies of the project and vendor pages, which suggests the product may no longer be actively supported.
How to check if you're exposed
Check by hand because this is a standalone web application.
- Identify whether your school or organization runs School ERP Pro and which version.
- Review web server logs for requests where es_messagesid contains anything other than a plain number.
- Look at the messages feature in the code or in the interface to see where this parameter is used.
- Confirm whether the application is exposed to the internet.
What to do now
- Find every installation and confirm the version.
- Limit access to trusted networks or require a VPN.
- Ask the vendor whether a fixed release exists. The record does not name one.
- If the product is unsupported, plan a migration and export the data safely.
- Back up the database and review accounts for unexpected changes.
Why it matters
The weakness is CWE-89, SQL injection. The application builds a database query by putting request data straight into the query text. The database cannot tell which part is the developer's instruction and which part came from the visitor, so crafted input can change what the query does.
School systems keep records about children and staff. A flaw that lets an outsider read or alter that data has legal and safeguarding implications beyond the technical fix, so lean toward isolating the system first and investigating second.
The fix for this class is well understood. Use parameterized queries or prepared statements so that input is always treated as data, validate values against an allowlist where only a few are valid, and give the application database account only the rights it needs. None of this is complicated, but it has to be applied to every query in the code base, which is why one reported parameter is often a sign of others.
Quick check
Why mention that the vendor pages are archived?
The record links archived copies of the project and vendor pages. That is a signal the product may be unmaintained, so a patch may not arrive.
Sources
- Archived project page referenced by the record
- VulnCheck advisory
- Exploit-DB entry referenced by the record
Last reviewed: 19 October 2026.
