PT-2023-26649 · Unknown · Gugoan Economizzer

Florian Walter · Published 2023-09-27 · Updated 2023-10-03 · CVE-2023-38870

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gugoan Economizzer versions 0.9-beta1 and commit 3730880 (April 2023)

Description A SQL injection vulnerability exists in the cash book feature of gugoan Economizzer, specifically in the category id parameter, which is used to list accomplishments by category. This vulnerability allows for SQL injection attacks.

Recommendations For gugoan Economizzer version 0.9-beta1, consider disabling the feature to list accomplishments by category until a patch is available. For gugoan Economizzer commit 3730880 (April 2023), restrict access to the category id parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-38870

Affected Products

Gugoan Economizzer

References · 9

• 🔥 https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38870 · Exploit
• https://osv.dev/vulnerability/CVE-2023-38870 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38870 · Security Note
• https://github.com/gugoan/economizzer · Note
• https://twitter.com/VulmonFeeds/status/1707269598746214775 · Twitter Post
• https://t.me/cibsecurity/71177 · Telegram Post
• https://economizzer.org · Note
• https://t.me/cvenotify/58694 · Telegram Post
• https://twitter.com/CVEnew/status/1707238288522957059 · Twitter Post