Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2023-38873 EUVD-2023-2505GHSA-gc95-5mmp-mp6j

Economizzer vulnerable to Clickjacking

Published Sep 28, 2023 · Updated Sep 23, 2024 · Assigned by mitre

Description

The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist gugoan/economizzer <= 0.9-beta1 — GHSA-gc95-5mmp-mp6j

References