CVE-2020-37088
Unknown Unknown - Not Provided

Directory Traversal in School ERP Pro 1.0 Allows File Disclosure

Publication date: 2026-02-03

Last updated on: 2026-02-10

Assigner: VulnCheck

Description
School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php. Attackers can access sensitive configuration files by supplying directory traversal paths to retrieve system credentials and configuration information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-03
Last Modified
2026-02-10
Generated
2026-07-06
AI Q&A
2026-02-04
EPSS Evaluated
2026-07-05
NVD
CVE-2020-37088

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arox school_erp_pro 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

School ERP Pro 1.0 has a file disclosure vulnerability that allows attackers who are not authenticated to read arbitrary files on the system.

This is possible because the application does not properly validate the 'document' parameter in the download.php file, allowing attackers to manipulate it.

By using directory traversal techniques in this parameter, attackers can access sensitive configuration files, which may include system credentials and other important configuration information.

Impact Analysis

This vulnerability can have a significant impact because it allows unauthorized users to access sensitive files that should be protected.

Attackers could retrieve system credentials and configuration details, potentially leading to further compromise of the system or unauthorized access to sensitive data.

Since the vulnerability requires no authentication and has a high confidentiality impact (CVSS 3.1 score of 7.5 and CVSS 4.0 score of 8.7), it poses a serious security risk.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2020-37088. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart