PT-2023-9862 · Unknown · The Hackers Diet Plugin

Afex · Published 2023-10-29 · Updated 2024-05-17 · CVE-2007-10003

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions The Hackers Diet Plugin versions up to 0.9.6b

Description A critical issue has been found in the processing of the file ajax blurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely.

Recommendations For The Hackers Diet Plugin versions up to 0.9.6b, upgrade to version 0.9.7b to address this issue. As a temporary workaround, consider restricting access to the ajax blurb.php file until the upgrade is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2007-10003

Affected Products

The Hackers Diet Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-10003 · Security Note
• https://github.com/wp-plugins/the-hackers-diet/releases/tag/0.9.7b · Patch
• https://github.com/wp-plugins/the-hackers-diet/commit/7dd8acf7cd8442609840037121074425d363b694 · Patch
• https://vuldb.com/?id.243803 · Note
• https://t.me/cibsecurity/73118 · Telegram Post
• https://vuldb.com/?ctiid.243803 · Note