PT-2023-26649 · Unknown · Gugoan Economizzer

Florian Walter · Publicado 2023-09-27 · Atualizado 2023-10-03 · CVE-2023-38870

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gugoan Economizzer versions 0.9-beta1 and commit 3730880 (April 2023)

Description A SQL injection vulnerability exists in the cash book feature of gugoan Economizzer, specifically in the category id parameter, which is used to list accomplishments by category. This vulnerability allows for SQL injection attacks.

Recommendations For gugoan Economizzer version 0.9-beta1, consider disabling the feature to list accomplishments by category until a patch is available. For gugoan Economizzer commit 3730880 (April 2023), restrict access to the category id parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-38870

Produtos afetados

Gugoan Economizzer

Referências · 9

• 🔥 https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38870 · Exploit
• https://github.com/gugoan/economizzer · Nota
• https://twitter.com/VulmonFeeds/status/1707269598746214775 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-38870 · Aviso do Fabricante
• https://t.me/cibsecurity/71177 · Publicação no Telegram
• https://economizzer.org · Nota
• https://t.me/cvenotify/58694 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1707238288522957059 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-38870 · Nota de Segurança