CVE-2007-10003 (PHP, published 2023-10-29T18:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects some unknown processing of the file ajax_blurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely. Upgrading to version 0.9.7b is able to address this issue. The patch is named 7dd8acf7cd8442609840037121074425d363b694. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-243803.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/wp-plugins/the-hackers-diet
Files changed:
ajax_blurb.php
ajax_togo.php
hackersdiet.php
hackersdiet_chart.php
readme.txt
release.txt
weight_save.php
Commit message: Mostly SQL injection holes for chart, and other stuff i can't remember

git-svn-id: https://plugins.svn.wordpress.org/the-hackers-diet/trunk@11902 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
	$user_id = $_POST["user"];
	$user_id = $_POST["user"];
                                            <input type="checkbox" id="maint_mode" name="maint_mode" <?= ($options["maint_mode"]?"checked":"") ?>><br />
                                                echo "<span class=\"bad_trend\">Just hit your goal? Select Maintenance mode.</span>";
	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = $user_id and date > \"".date("Y-m-d", strtotime("$weeks weeks ago"))."\" order by date asc";
	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = $user_id and date >= \"$start_date\" and date <= \"$end_date\" order by date asc";
Tags: diet, weight loss
Stable tag: 0.9.6b
	print_r($_POST);

Fixed code:
	if (is_numeric($_POST['user'])) {
    	$user_id = $_POST["user"];   
    } else {
        exit;
    }
    if (is_numeric($_POST['user'])) {
    	$user_id = $_POST["user"];   
    } else {
        exit;
    }
			
  	} else if ($_GET["section"] == "edit") {
      /*********************************************
      *                                            *
      *                                            *
      *                 EDIT SCREEN                *
      *                                            *
      *                                            *
      *********************************************/
      echo "Edit screen not yet implemented... it's next on my list, I promise! :]";
							<div>
							  <h3><?php _e('Actions') ?></h3>
							  <ul>
							    <li><a href="<?= $_SERVER['PHP_SELF']."?page=hackersdiet.php&section=edit" ?>">Edit older weights</a></li>
							  </ul>
							</div>
                                            <input type="checkbox" id="maint_mode" name="maint_mode" <?= ($options["maint_mode"]?"checked":"") ?>>
                                                echo "<span class=\"bad_trend\">Just hit your goal?<br/>Select Maintenance mode.</span>";
if (!is_numeric($_GET["user"]) || !is_numeric($_GET["weeks"])) {
  exit;
}

	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = \"" . $user_id . "\" and date > \"".date("Y-m-d", strtotime("$weeks weeks ago"))."\" order by date asc";
	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = \"" . $user_id . "\" and date >= \"$start_date\" and date <= \"$end_date\" order by date asc";
Tags: diet, weight loss, graph, chart
Stable tag: 0.9.7b
v0.9.7b - 4/30/2007
---
Stubbed out editor section in code, hopefully will find time to implement in near future.
Cleaned up some code so the plugin is safer for public exposure

	//print_r($_POST);