SQL Injection Vulnerability in ChatBot Plugin for WordPress
CVE-2023-5204
Key Information:
- Vendor
- Quantumcloud
- Status
- Ai Chatbot
- Vendor
- CVE Published:
- 19 October 2023
Badges
Summary
The ChatBot plugin for WordPress contains a security flaw that allows unauthenticated attackers to exploit the $strid parameter, leading to SQL Injection attacks. Due to insufficient validation on user-provided inputs and a lack of proper preparation within the SQL queries, attackers can inject malicious SQL statements. This vulnerability can enable malicious actors to retrieve sensitive data from the database, thereby compromising the security of WordPress sites that utilize this plugin. It is crucial for users to assess their usage of this plugin and update to the latest version to mitigate this risk.
Affected Version(s)
AI ChatBot * <= 4.8.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved