CVE-2007-10003: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects some unknown processing of the file ajax_blurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely. Upgrading to version 0.9.7b is able to address this issue. The patch is named 7dd8acf7cd8442609840037121074425d363b694. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-243803.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2023-10-29T18:15Z
Repository: https://github.com/wp-plugins/the-hackers-diet
Language: PHP
Files changed: ajax_blurb.php, ajax_togo.php, hackersdiet.php, hackersdiet_chart.php, readme.txt, release.txt, weight_save.php
Commit date: 2007-05-01 03:26:14 +0000
Commit message: Mostly SQL injection holes for chart, and other stuff i can't remember

git-svn-id: https://plugins.svn.wordpress.org/the-hackers-diet/trunk@11902 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/ajax_blurb.php b/ajax_blurb.php
index 20390ef..b744da9 100644
--- a/ajax_blurb.php
+++ b/ajax_blurb.php
@@ -8,11 +8,15 @@ if (!$wpdb) {
 	eval($html);
 
 	mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
 	mysql_select_db(DB_NAME);
 
-	$user_id = $_POST["user"];
+	if (is_numeric($_POST['user'])) {
+    	$user_id = $_POST["user"];   
+    } else {
+        exit;
+    }
 } else {
 	$user_id = $user_ID;
 }
 
 require_once(dirname(__FILE__).'/hackersdiet_lib.php');
diff --git a/ajax_togo.php b/ajax_togo.php
index 66b79b8..e03433b 100644
--- a/ajax_togo.php
+++ b/ajax_togo.php
@@ -8,11 +8,15 @@ if (!$wpdb) {
 	eval($html);
 
 	mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
 	mysql_select_db(DB_NAME);
 
-	$user_id = $_POST["user"];
+    if (is_numeric($_POST['user'])) {
+    	$user_id = $_POST["user"];   
+    } else {
+        exit;
+    }
 } else {
 	$user_id = $user_ID;
 }
 
 require_once(dirname(__FILE__).'/hackersdiet_lib.php');
diff --git a/hackersdiet.php b/hackersdiet.php
index a40c3d9..245b31a 100644
--- a/hackersdiet.php
+++ b/hackersdiet.php
@@ -239,10 +239,20 @@ function hackdiet_option_page() {
 						</div>
 					</td>
 				</tr>
 			</table>
 			<?
+			
+  	} else if ($_GET["section"] == "edit") {
+      /*********************************************
+      *                                            *
+      *                                            *
+      *                 EDIT SCREEN                *
+      *                                            *
+      *                                            *
+      *********************************************/
+      echo "Edit screen not yet implemented... it's next on my list, I promise! :]";
 		} else {
 			/**********************************************
 			*                                             *
 			*                                             *
 			*                  MAIN PAGE                  *
@@ -322,10 +332,16 @@ function hackdiet_option_page() {
 									<li><a href="<?=$report_url . "&start_date=".date("Y-m-01", strtotime("-2 months"))."&end_date=".date("Y-m-t")?>">Quarterly</a></li>
 									<li><a href="<?=$report_url . "&start_date=".date("Y-01-01")."&end_date=".date("Y-m-d")?>">Year to date</a></li>
 									<li><a href="<?=$report_url . "&show=all"?>">Complete history</a></li>
 								</ul>
 							</div>
+							<div>
+							  <h3><?php _e('Actions') ?></h3>
+							  <ul>
+							    <li><a href="<?= $_SERVER['PHP_SELF']."?page=hackersdiet.php&section=edit" ?>">Edit older weights</a></li>
+							  </ul>
+							</div>
 							<div>
 								<h3><?php _e('Updates'); ?></h3>
 								<?
 									if ( file_exists(ABSPATH . WPINC . '/rss.php') )
 										require_once(ABSPATH . WPINC . '/rss.php');
@@ -370,14 +386,14 @@ function hackdiet_option_page() {
 									<tr>
 										<td><b>Goal Weight:</b></td>
 										<td><input type="text" id="goal_weight" name="goal_weight" value="<?=$options["goal_weight"]?>"></td>
                                         <td>Maintenance mode?</td>
                                         <td>
-                                            <input type="checkbox" id="maint_mode" name="maint_mode" <?= ($options["maint_mode"]?"checked":"") ?>><br />
+                                            <input type="checkbox" id="maint_mode" name="maint_mode" <?= ($options["maint_mode"]?"checked":"") ?>>
                                             <?
                                             if ($options["goal_weight"] && $current_trend <= $options["goal_weight"] && !$options["maint_mode"]) {
-                                                echo "<span class=\"bad_trend\">Just hit your goal? Select Maintenance mode.</span>";
+                                                echo "<span class=\"bad_trend\">Just hit your goal?<br/>Select Maintenance mode.</span>";
                                             }
                                             ?>
                                         </td>
 									</tr>
 									<tr>
diff --git a/hackersdiet_chart.php b/hackersdiet_chart.php
index d13c0e4..f7aeb6d 100644
--- a/hackersdiet_chart.php
+++ b/hackersdiet_chart.php
@@ -11,21 +11,25 @@ $html = str_replace ("?>", "", $html);
 eval($html);
 
 mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
 mysql_select_db(DB_NAME);
 
+if (!is_numeric($_GET["user"]) || !is_numeric($_GET["weeks"])) {
+  exit;
+}
+
 $weeks = $_GET["weeks"];
 $start_date = $_GET["start_date"];
 $end_date = $_GET["end_date"];
 $goal = $_GET["goal"];
 $user_id = $_GET["user"];
 $maint_mode = $_GET["maint_mode"];
 
 if ($weeks) {
-	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = $user_id and date > \"".date("Y-m-d", strtotime("$weeks weeks ago"))."\" order by date asc";
+	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = \"" . $user_id . "\" and date > \"".date("Y-m-d", strtotime("$weeks weeks ago"))."\" order by date asc";
 } else if ($start_date and $end_date) {
-	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = $user_id and date >= \"$start_date\" and date <= \"$end_date\" order by date asc";
+	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = \"" . $user_id . "\" and date >= \"$start_date\" and date <= \"$end_date\" order by date asc";
 }
 
 $result = mysql_query($query);
 if (mysql_num_rows($result)) {
 	if (mysql_num_rows($result) == 1) {
diff --git a/readme.txt b/readme.txt
index 690e32d..a8d9392 100755
--- a/readme.txt
+++ b/readme.txt
@@ -1,11 +1,11 @@
 === The Hacker's Diet ===
 Contributors: afex
-Tags: diet, weight loss
+Tags: diet, weight loss, graph, chart
 Requires at least: 2.0.7
 Tested up to: 2.1.3
-Stable tag: 0.9.6b
+Stable tag: 0.9.7b
 
 Helps you track and predict weight loss using your Wordpress blog.  Daily weight entry, trend calculations, and more.
 
 == Description ==
 
diff --git a/release.txt b/release.txt
index 76d6287..873d444 100644
--- a/release.txt
+++ b/release.txt
@@ -13,10 +13,15 @@ Installation:
 6. Profit!
 
 
 Versions:
 ---------
+v0.9.7b - 4/30/2007
+---
+Stubbed out editor section in code, hopefully will find time to implement in near future.
+Cleaned up some code so the plugin is safer for public exposure
+
 v0.9.6b - 4/10/2007
 ---
 Figured out how to activate and reference paths in a general way so plugin directory name can be arbitrary.
 
 v0.9.5b - 4/3/2007
diff --git a/weight_save.php b/weight_save.php
index bc92090..10377fb 100644
--- a/weight_save.php
+++ b/weight_save.php
@@ -9,11 +9,11 @@ eval($html);
 if (isset($_POST["id"]) && isset($_POST["user"]) && is_numeric($_POST["user"]) && isset($_POST["content"]) && is_numeric($_POST["content"])) {
 	$date = substr($_POST["id"], 7);
 	$user_id = $_POST["user"];
 	$weight = round($_POST["content"], 1);
 } else {
-	print_r($_POST);
+	//print_r($_POST);
 	echo "Please enter a valid number for your weight.";
 	exit;
 }
 
 mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);

Vulnerable code: 	$user_id = $_POST["user"];
	$user_id = $_POST["user"];
                                            <input type="checkbox" id="maint_mode" name="maint_mode" <?= ($options["maint_mode"]?"checked":"") ?>><br />
                                                echo "<span class=\"bad_trend\">Just hit your goal? Select Maintenance mode.</span>";
	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = $user_id and date > \"".date("Y-m-d", strtotime("$weeks weeks ago"))."\" order by date asc";
	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = $user_id and date >= \"$start_date\" and date <= \"$end_date\" order by date asc";
Tags: diet, weight loss
Stable tag: 0.9.6b
	print_r($_POST);
Fixed code: 	if (is_numeric($_POST['user'])) {
    	$user_id = $_POST["user"];   
    } else {
        exit;
    }
    if (is_numeric($_POST['user'])) {
    	$user_id = $_POST["user"];   
    } else {
        exit;
    }
			
  	} else if ($_GET["section"] == "edit") {
      /*********************************************
      *                                            *
      *                                            *
      *                 EDIT SCREEN                *
      *                                            *
      *                                            *
      *********************************************/
      echo "Edit screen not yet implemented... it's next on my list, I promise! :]";
							<div>
							  <h3><?php _e('Actions') ?></h3>
							  <ul>
							    <li><a href="<?= $_SERVER['PHP_SELF']."?page=hackersdiet.php&section=edit" ?>">Edit older weights</a></li>
							  </ul>
							</div>
                                            <input type="checkbox" id="maint_mode" name="maint_mode" <?= ($options["maint_mode"]?"checked":"") ?>>
                                                echo "<span class=\"bad_trend\">Just hit your goal?<br/>Select Maintenance mode.</span>";
if (!is_numeric($_GET["user"]) || !is_numeric($_GET["weeks"])) {
  exit;
}

	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = \"" . $user_id . "\" and date > \"".date("Y-m-d", strtotime("$weeks weeks ago"))."\" order by date asc";
	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = \"" . $user_id . "\" and date >= \"$start_date\" and date <= \"$end_date\" order by date asc";
Tags: diet, weight loss, graph, chart
Stable tag: 0.9.7b
v0.9.7b - 4/30/2007
---
Stubbed out editor section in code, hopefully will find time to implement in near future.
Cleaned up some code so the plugin is safer for public exposure

	//print_r($_POST);