CVE-2023-3061

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file btn_functions.php of the component Attachment Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-230567.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
code-projects	Agro-School Management System	1.0

References

https://github.com/hotencode/CveHub/blob/main/Agro-School%20Management%20System%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.230567Permissions Required, Third Party Advisory
https://vuldb.com/?id.230567Third Party Advisory
https://github.com/hotencode/CveHub/blob/main/Agro-School%20Management%20System%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.230567Permissions Required, Third Party Advisory
https://vuldb.com/?id.230567Third Party Advisory

Timeline

Published: Jun 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-306105.5aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `De CVE-2023-306115.3Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected version CVE-2023-306124.9Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors CVE-2023-306139.0Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCM CVE-2023-306146.1Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflecte CVE-2023-306155.4Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site CVE-2023-306166.5Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery CVE-2023-306176.5Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1 CVE-2023-306183.3Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and veri CVE-2023-306195.4Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifact CVE-2023-30629.8A vulnerability was found in code-projects Agro-School Management System 1.0. It has been classified as critical. Affected is an unknown fun CVE-2023-306207.5mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed u