CVE-2007-10003 (published 2023-10-29T18:15Z)

A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects some unknown processing of the file ajax_blurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely. Upgrading to version 0.9.7b is able to address this issue. The patch is named 7dd8acf7cd8442609840037121074425d363b694. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-243803.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/wp-plugins/the-hackers-diet
commit_details: repo_url: https://github.com/wp-plugins/the-hackers-diet
author: afex
author_date: 2007-05-01 03:26:14+00:00
msg: Mostly SQL injection holes for chart, and other stuff i can't remember

git-svn-id: https://plugins.svn.wordpress.org/the-hackers-diet/trunk@11902 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/the-hackers-diet
repo_name: wp-plugins/the-hackers-diet
description: WordPress.org Plugin Mirror
repo_language: JavaScript
owner: wp-plugins
file_changes: filename: ajax_blurb.php
change_type: ModificationType.MODIFY
diff: @@ -10,7 +10,11 @@ if (!$wpdb) {
 	mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
 	mysql_select_db(DB_NAME);
 
-	$user_id = $_POST["user"];
+	if (is_numeric($_POST['user'])) {
+    	$user_id = $_POST["user"];   
+    } else {
+        exit;
+    }
 } else {
 	$user_id = $user_ID;
 }

programming_language: PHP
filename: ajax_togo.php
change_type: ModificationType.MODIFY
diff: @@ -10,7 +10,11 @@ if (!$wpdb) {
 	mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
 	mysql_select_db(DB_NAME);
 
-	$user_id = $_POST["user"];
+    if (is_numeric($_POST['user'])) {
+    	$user_id = $_POST["user"];   
+    } else {
+        exit;
+    }
 } else {
 	$user_id = $user_ID;
 }

programming_language: PHP
filename: hackersdiet.php
change_type: ModificationType.MODIFY
diff: @@ -241,6 +241,16 @@ function hackdiet_option_page() {
 				</tr>
 			</table>
 			<?
+			
+  	} else if ($_GET["section"] == "edit") {
+      /*********************************************
+      *                                            *
+      *                                            *
+      *                 EDIT SCREEN                *
+      *                                            *
+      *                                            *
+      *********************************************/
+      echo "Edit screen not yet implemented... it's next on my list, I promise! :]";
 		} else {
 			/**********************************************
 			*                                             *
@@ -324,6 +334,12 @@ function hackdiet_option_page() {
 									<li><a href="<?=$report_url . "&show=all"?>">Complete history</a></li>
 								</ul>
 							</div>
+							<div>
+							  <h3><?php _e('Actions') ?></h3>
+							  <ul>
+							    <li><a href="<?= $_SERVER['PHP_SELF']."?page=hackersdiet.php&section=edit" ?>">Edit older weights</a></li>
+							  </ul>
+							</div>
 							<div>
 								<h3><?php _e('Updates'); ?></h3>
 								<?
@@ -372,10 +388,10 @@ function hackdiet_option_page() {
 										<td><input type="text" id="goal_weight" name="goal_weight" value="<?=$options["goal_weight"]?>"></td>
                                         <td>Maintenance mode?</td>
                                         <td>
-                                            <input type="checkbox" id="maint_mode" name="maint_mode" <?= ($options["maint_mode"]?"checked":"") ?>><br />
+                                            <input type="checkbox" id="maint_mode" name="maint_mode" <?= ($options["maint_mode"]?"checked":"") ?>>
                                             <?
                                             if ($options["goal_weight"] && $current_trend <= $options["goal_weight"] && !$options["maint_mode"]) {
-                                                echo "<span class=\"bad_trend\">Just hit your goal? Select Maintenance mode.</span>";
+                                                echo "<span class=\"bad_trend\">Just hit your goal?<br/>Select Maintenance mode.</span>";
                                             }
                                             ?>
                                         </td>

programming_language: PHP
filename: hackersdiet_chart.php
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,10 @@ eval($html);
 mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
 mysql_select_db(DB_NAME);
 
+if (!is_numeric($_GET["user"]) || !is_numeric($_GET["weeks"])) {
+  exit;
+}
+
 $weeks = $_GET["weeks"];
 $start_date = $_GET["start_date"];
 $end_date = $_GET["end_date"];
@@ -21,9 +25,9 @@ $user_id = $_GET["user"];
 $maint_mode = $_GET["maint_mode"];
 
 if ($weeks) {
-	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = $user_id and date > \"".date("Y-m-d", strtotime("$weeks weeks ago"))."\" order by date asc";
+	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = \"" . $user_id . "\" and date > \"".date("Y-m-d", strtotime("$weeks weeks ago"))."\" order by date asc";
 } else if ($start_date and $end_date) {
-	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = $user_id and date >= \"$start_date\" and date <= \"$end_date\" order by date asc";
+	$query = "select date, weight, trend from ".$table_prefix."hackdiet_weightlog where wp_id = \"" . $user_id . "\" and date >= \"$start_date\" and date <= \"$end_date\" order by date asc";
 }
 
 $result = mysql_query($query);

programming_language: PHP
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -1,9 +1,9 @@
 === The Hacker's Diet ===
 Contributors: afex
-Tags: diet, weight loss
+Tags: diet, weight loss, graph, chart
 Requires at least: 2.0.7
 Tested up to: 2.1.3
-Stable tag: 0.9.6b
+Stable tag: 0.9.7b
 
 Helps you track and predict weight loss using your Wordpress blog.  Daily weight entry, trend calculations, and more.
 

programming_language: Markdown
filename: release.txt
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,11 @@ Installation:
 
 Versions:
 ---------
+v0.9.7b - 4/30/2007
+---
+Stubbed out editor section in code, hopefully will find time to implement in near future.
+Cleaned up some code so the plugin is safer for public exposure
+
 v0.9.6b - 4/10/2007
 ---
 Figured out how to activate and reference paths in a general way so plugin directory name can be arbitrary.

programming_language: Markdown
filename: weight_save.php
change_type: ModificationType.MODIFY
diff: @@ -11,7 +11,7 @@ if (isset($_POST["id"]) && isset($_POST["user"]) && is_numeric($_POST["user"]) &
 	$user_id = $_POST["user"];
 	$weight = round($_POST["content"], 1);
 } else {
-	print_r($_POST);
+	//print_r($_POST);
 	echo "Please enter a valid number for your weight.";
 	exit;
 }

programming_language: PHP