CVE-2023-38870

A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.83% chance of exploitation in the next 30 days, 55th percentile

Published

2023-09-28

Updated

2024-09-24

Proof-of-concept exploits (1)

• dub-flow/vulnerability-research/tree/main/CVE-2023-38870

References

• CVE Record
• NVD entry

Related

• CVE-2023-38872
• CVE-2023-38874
• CVE-2023-38877
• CVE-2023-40618
• CVE-2023-3887
• CVE-2023-38866