Vulnerability Details CVE-2023-38874
A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.324
EPSS Ranking 96.6%
CVSS Severity
CVSS v3 Score 8.8
References
Products affected by CVE-2023-38874
-
cpe:2.3:a:economizzer:economizzer:0.9
-
cpe:2.3:a:economizzer:economizzer:april_2023