CVE-2023-38870

A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.03% chance of exploitation in the next 30 days, 63rd percentile

Published

2023-09-28

Updated

2024-09-24

Proof-of-concept exploits (1)

• dub-flow/vulnerability-research/tree/main/CVE-2023-3887051★ · 2024-03-10

Security advisories

• gugoan/economizzer
• https://www.economizzer.org

References

• CVE Record
• NVD entry

Related

• CVE-2023-38872
• CVE-2023-38874
• CVE-2023-38877
• CVE-2023-40618