Description

WordPress Plugin AI ChatBot is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin AI ChatBot versions up to, and including, 4.8.9 and version 4.9.2 are vulnerable.

Remediation

Update to plugin versions 4.9.1, 4.9.3 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chatbot/ai-chatbot-489-authenticated-subscriber-directory-traversal-to-arbitrary-file-write-via-qcld-openai-upload-pagetraining-file

https://packetstormsecurity.com/files/175371/WordPress-AI-ChatBot-4.8.9-SQL-Injection-Traversal-File-Deletion.html

https://plugins.svn.wordpress.org/chatbot/trunk/readme.txt

Related Vulnerabilities

WordPress 'wp-admin/admin.php' Module Configuration Security Bypass Vulnerability (0.6.2 - 2.8)

PostgreSQL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-0773)

WordPress Plugin Slimstat Analytics SQL Injection (4.9.3.2)

WordPress Plugin Affiliate Press Multiple Cross-Site Scripting Vulnerabilities (0.3.8)

Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-14443)

Severity

High

Classification

CVE-2023-5241 CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Directory Traversal