by Kastro
Paper/Archive/CVE-2023-1650

CVE-2023-1650

Unknown AI ChatBot — ChatBot < 4.4.7 - Unauthenticated PHP Object Injection

EPSS 34%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.4.984 × 2019.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog

Affected

ProductAffectedFixed inSource
AI ChatBot< 4.4.74.4.7CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

exploitwpscan.com/vulnerability/7d7fe498-0aa3-4fa7-b560-610b42b2abed