CVE-2023-6063 — WP Fastest Cache SQL Injection PoC

Proof of Concept (PoC) for CVE-2023-6063, an unauthenticated, time-based blind SQL injection vulnerability affecting WP Fastest Cache ≤ 1.2.2.

The vulnerability can be triggered through the wordpress_logged_in cookie and may allow an attacker to infer sensitive information from the WordPress database, including password hashes and email addresses.

For authorized security testing and educational purposes only.

Features

• Time-based blind SQL injection testing.

• Character-by-character data extraction using SQL SLEEP() delays.

• Target a specific WordPress username.

• Optional password-hash validation.

• Optional email extraction.

• Custom cookie support.

• Configurable response delay.

• Debug mode for troubleshooting.

• Selective extraction using:

  • --just-hash
  • --just-email

Data That Can Be Extracted

Depending on the target configuration and database contents, the PoC can extract:

• WordPress password hashes from wp_users.user_pass.
• Associated email addresses from wp_users.user_email.

Requirements

• Python 3.x
• A target running a vulnerable version of WP Fastest Cache.
• Network connectivity to the target.
• Authorization to perform security testing.

Install the required Python dependencies:

pip install -r requirements.txt

Usage

Basic Usage

python3 poc.py -u https://vulnerable-website.example --username admin --delay 5

Replace the example URL with a system you are explicitly authorized to test.

Command-Line Options

-h, --help
    Show the help message and exit.

-u URL, --url URL
    Full URL of the WordPress installation to test.

--username USERNAME
    Specify the WordPress username whose information should be tested.

-d DELAY, --delay DELAY
    Response delay used for time-based testing.
    Default: 5 seconds.
    Minimum: 2 seconds.

-H HASH, --hash HASH
    Hash to verify against the wp_users table.
    If the hash contains special characters, wrap it in single quotes.

--domain DOMAIN
    Domain used for email validation.

-c COOKIE, --cookie COOKIE
    Specify a custom cookie name if the target uses a different context.

--status-code STATUS_CODE
    Specify the expected positive HTTP status code.
    Default: 200.

--debug
    Enable additional debugging output.

--just-hash
    Extract only the password hash.

--just-email
    Extract only the email address.

Technical Details

Vulnerability Description

CVE-2023-6063 affects WP Fastest Cache versions ≤ 1.2.2.

The vulnerability is an unauthenticated blind SQL injection that can be triggered through the wordpress_logged_in cookie.

The issue can be abused to perform time-based inference against the WordPress database. By measuring differences in HTTP response times, individual characters of database values can potentially be inferred without directly receiving the queried data in the HTTP response.

A simplified example of the underlying technique is:

" AND (IF(
    (SELECT user_pass
     FROM wp_users
     WHERE user_login="admin") LIKE 'a%',
    SLEEP(5),
    0
))-- -

If the tested condition evaluates to true, the database introduces a delay. Repeating this process with different characters allows information to be inferred character by character.

Vulnerability Information

Attack Vector

Exploitability

• Remote: The vulnerability can be triggered through HTTP requests.
• Authentication: No WordPress authentication is required to trigger the vulnerability.
• Complexity: Relatively low when the vulnerable conditions are present.

Potential Impact

Potentially exposed information includes WordPress user password hashes and email addresses.

Demo

The following demonstration shows the PoC being used against an authorized test environment:

Password Hash Analysis

When a WordPress password hash has been legitimately obtained during an authorized security assessment, password-auditing tools such as John the Ripper or Hashcat can be used to assess password strength.

For example, with John the Ripper:

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt --format=phpass

Only perform password auditing against hashes you are authorized to possess and test.

Affected Versions

WP Fastest Cache:

≤ 1.2.2

Mitigation

The recommended mitigation is to upgrade WP Fastest Cache to a version that contains the security fix.

Additional defensive measures include:

1. Keep WordPress plugins updated.
2. Remove plugins that are no longer required.
3. Deploy appropriate WAF rules to detect and block SQL injection attempts.
4. Monitor suspicious requests containing SQL syntax in HTTP cookies.
5. Review WordPress user accounts and credentials after a suspected compromise.
6. Rotate potentially exposed credentials when appropriate.

Recommended: Upgrade WP Fastest Cache to 1.2.3 or later.

References

• NIST NVD — CVE-2023-6063
• WordPress Plugin — WP Fastest Cache
• CVE Details — CVE-2023-6063

Legal Disclaimer

This project is provided for educational purposes and authorized security research only.

Do not use this PoC against systems, websites, applications, or infrastructure without explicit permission from the owner.

The author is not responsible for misuse, damage, data loss, unauthorized access, or any other consequences resulting from the use of this software.

Only test systems you own or have explicit authorization to assess.

License

This project is released under the GNU General Public License v3.0 (GPLv3).