Description

WordPress Plugin AI ChatBot is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin AI ChatBot version 4.8.9 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 4.9.1 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chatbot/chatbot-489-unauthenticated-sql-injection-via-qc-wpbo-search-response

https://packetstormsecurity.com/files/175371/WordPress-AI-ChatBot-4.8.9-SQL-Injection-Traversal-File-Deletion.html

https://plugins.svn.wordpress.org/chatbot/trunk/readme.txt

Related Vulnerabilities

Joomla! Core 3.x.x Cross-Site Scripting (3.0.0 - 3.9.25)

WordPress Plugin FCChat Widget 'Upload.php' Arbitrary File Upload (2.2.13.1)

Python Uncontrolled Search Path Element Vulnerability (CVE-2020-15523)

WordPress Plugin Request For Quote Cross-Site Request Forgery (1.2)

Oracle Database Server CVE-2013-1519 Vulnerability (CVE-2013-1519)

Severity

High

Classification

CVE-2023-5204 CWE-89 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection