PT-2023-9862 · Unknown · The Hackers Diet Plugin

Afex · Publicado 2023-10-29 · Atualizado 2024-05-17 · CVE-2007-10003

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions The Hackers Diet Plugin versions up to 0.9.6b

Description A critical issue has been found in the processing of the file ajax blurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely.

Recommendations For The Hackers Diet Plugin versions up to 0.9.6b, upgrade to version 0.9.7b to address this issue. As a temporary workaround, consider restricting access to the ajax blurb.php file until the upgrade is applied.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2007-10003

Produtos afetados

The Hackers Diet Plugin

Referências · 6

• https://vuldb.com/?id.243803 · Nota
• https://t.me/cibsecurity/73118 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2007-10003 · Nota de Segurança
• https://github.com/wp-plugins/the-hackers-diet/releases/tag/0.9.7b · Correção
• https://github.com/wp-plugins/the-hackers-diet/commit/7dd8acf7cd8442609840037121074425d363b694 · Correção
• https://vuldb.com/?ctiid.243803 · Nota