PT-2023-22807 · Code Projects · Agro-School Management System

Zhangwang · Publicado 2023-06-02 · Atualizado 2024-05-17 · CVE-2023-3061

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions code-projects Agro-School Management System version 1.0

Description A critical issue affects the Attachment Image Handler component, specifically the file btn functions.php, leading to unrestricted upload. The attack can be initiated remotely.

Recommendations For code-projects Agro-School Management System version 1.0, consider disabling the Attachment Image Handler component until a patch is available. Restrict access to the btn functions.php file to minimize the risk of exploitation. Avoid using the Attachment Image Handler feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-3061

Produtos afetados

Agro-School Management System

Referências · 8

• 🔥 https://github.com/hotencode/CveHub/blob/main/Agro-School%20Management%20System%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-3061 · Nota de Segurança
• https://vuldb.com/?ctiid.230567 · Nota
• https://osv.dev/vulnerability/CVE-2023-3061 · Aviso do Fabricante
• https://t.me/cibsecurity/64890 · Publicação no Telegram
• https://vuldb.com/?id.230567 · Nota
• https://t.me/cvenotify/51628 · Publicação no Telegram
• https://t.me/cvenotify/51980 · Publicação no Telegram