CVE-2023-38874

CVE-2023-38874 is a high-severity remote code execution (RCE) vulnerability affecting gugoan's Economizzer v.0.9-beta1 and commit 3730880. An authenticated attacker can upload a malicious PHP web shell as an attachment when creating a new cash book entry, subsequently executing arbitrary commands. With a CVSS score of 8.8 (HIGH), this vulnerability is easily exploitable over the network with low privileges and no user interaction, leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or significant community discussion, its high FAUCET Risk Score of 91/100 and EPSS score indicate a notable potential for future exploitation.