Ai Engine
CVE-2024-10499
HIGH
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (wpscan) · only source for this CVE.
CVSS VectorVendor: wpscan
Lifecycle Timeline
1DescriptionCVE.org
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks
AnalysisAI
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks Affected products include: Meowapps Ai Engine. Version information: before 2.6.5.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.
Unrestricted file upload in Jordy Meow's AI Engine: ChatGPT Chatbot plugin for WordPress (versions up to and including 1
Arbitrary file write in the AI Engine WordPress plugin before 3.5.5 lets authenticated editor-level users abuse an unsan
Path traversal in the AI Engine WordPress plugin (versions 3.3.3 through 3.7.1) allows arbitrary server file reads with
Privilege escalation in the AI Engine WordPress plugin (versions 2.8.0 through 3.6.0) enables any sub-site Administrator
AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. Rated high severity (CVSS 7.2), this
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.1.4. Rated medium severity (CV
Cleartext exposure of third-party API keys and authentication tokens in AI Engine WordPress plugin (before 3.6.4) allows
Unauthorized access to private chatbot conversations in the AI Engine WordPress plugin before 3.5.5 allows any authentic
Unauthenticated remote attackers can invoke AI queries against a site owner's configured provider account through the AI
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.2.63. Rated criti
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.1.4. Rated critic
Path traversal in the AI Engine WordPress plugin before 3.6.6 allows server-side file contents to be read and exfiltrate
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today