CVE-2023-3094
About
A vulnerability classified as critical has been found in code-projects Agro-School Management System 1.0. Affected is the function doUpdateQuestion of the file btn_functions.php. The manipulation of the argument question_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230670 is the identifier assigned to this vulnerability.
Rainforest analyst review
This is a straightforward SQL injection in the Agro-School Management System: the doUpdateQuestion routine in btn_functions.php trusts the question_id argument and drops it into a query, so a crafted value rewrites the SQL. From there an attacker reads or tampers with whatever the app's database holds — student and staff records, credentials, grades. The vector is remote and needs only a low-privileged account.
Honesty matters on tempo here. A public exploit exists (VDB-230670) and it targets a real injection point, so this isn't theoretical — but code-projects Agro-School Management System is niche academic-project software with a tiny, scattered install base, not something mass-scanning botnets fingerprint at scale. The realistic threat is an opportunistic actor who finds one of the few internet-exposed instances, or a low-privileged user pivoting inside an institution that runs it.
So we rank this below its 6.3 headline unless we actually find it deployed. Our first move is reachability: does this application appear anywhere in the estate, and is it exposed beyond an internal network? For obscure PHP apps like this the inventory answer usually is nowhere, and when that's true a public PoC against software we don't run is noise, not risk.
References
Related CVEs
Frequently asked questions
What is CVE-2023-3094?
A vulnerability classified as critical has been found in code-projects Agro-School Management System 1.0. Affected is the function doUpdateQuestion of the file btn_functions.php. The manipulation of the argument question_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230670 is the identifier assigned to this vulnerability.
How severe is CVE-2023-3094?
CVE-2023-3094 carries a CVSS 3.1 base score of 6.3, rated medium. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 67 out of 100, in the elevated band.
How is CVE-2023-3094 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L): attack vector Network, attack complexity Low, privileges required Low, user interaction None. Impact on confidentiality Low, integrity Low and availability Low.
Which products are affected by CVE-2023-3094?
Public advisories list the following as affected: agro-school management system. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2023-3094?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.