SZB-b43ff61f4a
EUVD lists contributor-level PHP object injection in Frisbii Pay up to 1.8.19
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Frisbii
- Product
- Frisbii Pay
- First seen
Summary
The EUVD listing, shared via a Mastodon post, describes a contributor-level PHP object injection flaw in Frisbii Pay versions up to 1.8.19. It is scored 8.8 (CVSS v3.1) and attributed to vendor Frisbii.
If you use Frisbii
Check whether Frisbii Pay is installed and which version is running
Update to a fixed version from Frisbii once one is released
Review contributor accounts and limit them to trusted users until patched
What the sources say 1
· Mastodon: “Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.” Source