Economizzer vulnerabilities
We track 3 vulnerabilities in Economizzer products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 28, 2023.
Latest Economizzer vulnerabilities
- 8.8 High severity
Economizzer: Improper Control of Generation of Code
A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked
- 8.8 High severity
Economizzer: Unrestricted Upload of File with Dangerous Type
A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards,
- 9.8 Critical severity
Economizzer: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection.