What the vulnerability does
01Description
A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects some unknown processing of the file ajax_blurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely. Upgrading to version 0.9.7b is able to address this issue. The patch is named 7dd8acf7cd8442609840037121074425d363b694. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-243803.
Explanation of Vulnerability in Simple Terms
02Summary
The Hackers Diet Plugin version 0.9.6b contains a SQL injection vulnerability in its database queries. An attacker with low-level site access can inject malicious SQL code to read, modify, or delete database records. The vulnerability requires authentication but no user interaction. Site administrators should update to a patched version immediately.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete database records via SQL injection.
Potential impact on your site
04Site Impact
Unauthorized access to sensitive data, data corruption, or data loss affecting site functionality and user information.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
October 29, 2023
CVE published
September 6, 2024
Record updated
