MATCHA INVOICE SQL Injection Vulnerability

A SQL injection vulnerability has been identified in MATCHA INVOICE versions through 2.6.6. This vulnerability allows logged-in users to execute arbitrary SQL commands via specific parameters, potentially leading to unauthorized access, modification, or deletion of database information.

Impact

Exploitation of this vulnerability could result in unauthorized access to, or manipulation of, database information by logged-in users.

Remediation

Users are advised to update MATCHA INVOICE to version 2.6.7, which addresses this vulnerability. The latest version can be downloaded from the product's download page.