JVN#66984217: MATCHA INVOICE vulnerable to code injection

MATCHA INVOICE provided by ICZ Corporation is a web-based billing management software. MATCHA INVOICE contains a code injection (CWE-94) vulnerability due to a flaw when configuring the database during installation.

Impact

An unauthenticated attacker who can execute the installer may execute arbitrary PHP code on the server where MATCHA INVOICE resides.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• MATCHA INVOICE 2.5.6 and earlier